Jul-08-2021, 02:33 PM
I Need Help in This Exercises Please
Final exercise in the Network Infrastructure Programming course - 5741
1 Mission
Write / write a program in the Python programming language that will implement a communication intrusion detection system called in English called IDS - Intrusion Detection System.
1.1 Functional requirements
All IPv4 only requirements.
The system will listen to the network and perform the following actions on each packet of information on the network (Packet): (each action in a separate function)
• Identify TCP / IP connection attempts and check against a blacklist and a whitelist
• Write down the number of TCP and UDP facts between any two addresses
• Identify ARP information packets and verify that each ARP response has an ARP request
• The system will detect DNS information packets (UDP port 53) and record the sent DNS addresses
1.2 System design
The system has 3 running stages:
1.2.1 Boot
At this point the following steps will be performed:
• Read configuration files:
o White address list file - A file that contains an approved address list for the link
o Black Address List File - A file that contains a list of forbidden addresses to link to
• Initialization of information structures (arrays, dictionaries)
1.2.2 Running phase
At this point the following steps will be performed:
• Listening to information packages for 1,000 - 10,000 information packages (for the developers' choice)
• Deciphering the information packages and checking them
• Collection of test results
1.2.3 Production of a report
At this point a report will be produced containing all the results of the tests collected
2 Details of the information package tests
2.1 Contacting an IP address in front of a blacklist and a whitelist
2.1.1 Detailed requirements:
• The function will detect any attempt to contact (the SYNC flag is actually lit)
• The function will classify and record any such experience as:
o Allowed
o Forbidden
o Unknown
The registration will include a source address and a destination address for each attempt
• At the end of the run, the results will be printed on the screen
2.1.2 Execution proposal:
• Definition of 3 arrays / dictionaries - white link, black link, unknown link
• After the classification, the source and destination addresses will be registered in the appropriate array / dictionary
2.2 Counting Information Packages
2.2.1 Detailed requirements:
• The function will count (count) the information packets (facts) for each pair of source address + destination address
• At the end of the run, the results will be printed sorted in descending order (the couple with the most packages first)
2.2.2 Execution proposal:
• Set up a dictionary where the key is the source address + destination address (for example "192.168.1.1-8.8.8.8") and the value is the number of information packets
2.3 ARP testing
2.3.1 Detailed requirements
• The system will check that each ARP response has a suitable request (designed to prevent ARP Spoofing)
• At the end of the process, the status of all ARP requests will be printed
2.3.2 Proposal for realization
• Set up a dictionary where the key is the requested ARP address and the value is the status of the request
• Identify a request and answer
o For each request we add about 1
o For each answer we subtract 1 from the value
2.4 DNS check
2.4.1 Detailed requirements
• The system will detect outgoing DNS requests (UDP port 53)
• The system will remove the DNS address from the request
• At the end of the process, all the DNS addresses will be printed
Final exercise in the Network Infrastructure Programming course - 5741
1 Mission
Write / write a program in the Python programming language that will implement a communication intrusion detection system called in English called IDS - Intrusion Detection System.
1.1 Functional requirements
All IPv4 only requirements.
The system will listen to the network and perform the following actions on each packet of information on the network (Packet): (each action in a separate function)
• Identify TCP / IP connection attempts and check against a blacklist and a whitelist
• Write down the number of TCP and UDP facts between any two addresses
• Identify ARP information packets and verify that each ARP response has an ARP request
• The system will detect DNS information packets (UDP port 53) and record the sent DNS addresses
1.2 System design
The system has 3 running stages:
1.2.1 Boot
At this point the following steps will be performed:
• Read configuration files:
o White address list file - A file that contains an approved address list for the link
o Black Address List File - A file that contains a list of forbidden addresses to link to
• Initialization of information structures (arrays, dictionaries)
1.2.2 Running phase
At this point the following steps will be performed:
• Listening to information packages for 1,000 - 10,000 information packages (for the developers' choice)
• Deciphering the information packages and checking them
• Collection of test results
1.2.3 Production of a report
At this point a report will be produced containing all the results of the tests collected
2 Details of the information package tests
2.1 Contacting an IP address in front of a blacklist and a whitelist
2.1.1 Detailed requirements:
• The function will detect any attempt to contact (the SYNC flag is actually lit)
• The function will classify and record any such experience as:
o Allowed
o Forbidden
o Unknown
The registration will include a source address and a destination address for each attempt
• At the end of the run, the results will be printed on the screen
2.1.2 Execution proposal:
• Definition of 3 arrays / dictionaries - white link, black link, unknown link
• After the classification, the source and destination addresses will be registered in the appropriate array / dictionary
2.2 Counting Information Packages
2.2.1 Detailed requirements:
• The function will count (count) the information packets (facts) for each pair of source address + destination address
• At the end of the run, the results will be printed sorted in descending order (the couple with the most packages first)
2.2.2 Execution proposal:
• Set up a dictionary where the key is the source address + destination address (for example "192.168.1.1-8.8.8.8") and the value is the number of information packets
2.3 ARP testing
2.3.1 Detailed requirements
• The system will check that each ARP response has a suitable request (designed to prevent ARP Spoofing)
• At the end of the process, the status of all ARP requests will be printed
2.3.2 Proposal for realization
• Set up a dictionary where the key is the requested ARP address and the value is the status of the request
• Identify a request and answer
o For each request we add about 1
o For each answer we subtract 1 from the value
2.4 DNS check
2.4.1 Detailed requirements
• The system will detect outgoing DNS requests (UDP port 53)
• The system will remove the DNS address from the request
• At the end of the process, all the DNS addresses will be printed
