96 lines
2.9 KiB
TeX
96 lines
2.9 KiB
TeX
% Full instructions available at:
|
|
% https://github.com/elauksap/focus-beamertheme
|
|
|
|
\documentclass{beamer}
|
|
\usetheme[numbering=progressbar]{focus}
|
|
\usepackage{tikz}
|
|
\usetikzlibrary{positioning}
|
|
\usetikzlibrary{shapes,arrows}
|
|
\usepackage{transparent}
|
|
\usepackage{fancyvrb}
|
|
\usepackage{listings}
|
|
\definecolor{main}{RGB}{47, 161, 219}
|
|
%\definecolor{textcolor}{RGB}{128, 128, 128}
|
|
\definecolor{background}{RGB}{240, 247, 255}
|
|
\definecolor{textcolor}{RGB}{85, 87, 83}
|
|
\title{D4 Project}
|
|
\subtitle{PIBS - Passive Identification of BackScatter}
|
|
\author{TEAM CIRCL}
|
|
\titlegraphic{\includegraphics[scale=0.20]{d4-logo.pdf}}
|
|
\institute{Team CIRCL \\ \url{https://www.d4-project.org/}}
|
|
\date{20190329}
|
|
|
|
\begin{document}
|
|
\begin{frame}
|
|
\maketitle
|
|
\end{frame}
|
|
|
|
|
|
\begin{frame}
|
|
\frametitle{Open problems}
|
|
\framesubtitle{Filter out potential backscatter traffic}
|
|
\begin{itemize}
|
|
\item Differentiate Scanning activities\footnote{\url{https://nmap.org/book/man-port-scanning-techniques.html}}
|
|
\begin{itemize}
|
|
\item TCP SYN scan
|
|
\item XMAS scans
|
|
\item ACK scans
|
|
\item TCP Window scan
|
|
\item TCP Maimon scan
|
|
\item Custom TCP scan
|
|
\end{itemize}
|
|
\item Misconfigured systems
|
|
\item Malicious packets against D4 infrastructure
|
|
\item Handling file rotations
|
|
\item Expiration of state tables
|
|
\end{itemize}
|
|
\end{frame}
|
|
|
|
|
|
\begin{frame}[fragile]
|
|
\frametitle{Handling TCP SYN scans}
|
|
\begin{itemize}
|
|
\item Was the IP seen before?
|
|
\item Keep a hash table of all encountered IP addresses
|
|
\item Consider only IP addresses where the TCP SYN flag is set
|
|
\item Insert the IP and the timestamp in the hash table
|
|
\item Display new IP addresses
|
|
\end{itemize}
|
|
\begin{block}{PIBS tool}
|
|
\begin{verbatim}
|
|
pibs -r pcapfile.cap -b
|
|
\end{verbatim}
|
|
\end{block}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{Using PIBS as D4 analyzer}
|
|
\begin{itemize}
|
|
\item Chaining PIBS to D4 server
|
|
\item PIBS polls a redis queue for new created files
|
|
\item Each PIBS instance can have its UUID
|
|
\end{itemize}
|
|
\begin{block}{PIBS tool}
|
|
pibs -u e344c4fb-442e-45a6-92b9-d8e30aeef448 -z 127.0.0.1 -p 6379 -y 2
|
|
\end{block}
|
|
\begin{itemize}
|
|
\item -u specifies uuid
|
|
\item -z specifies the redis server
|
|
\item -p specifies the port of the redis server
|
|
\item -y specifies the redis database
|
|
\end{itemize}
|
|
\end{frame}
|
|
|
|
\begin{frame}
|
|
\frametitle{Using PIBS for further exploration}
|
|
\begin{itemize}
|
|
\item Often it is unknown which fields should be analysed during refinement
|
|
\item Read raw pcap and output raw pcap
|
|
\item Output pcap file can be further investigated with other tools such as Wireshark
|
|
\end{itemize}
|
|
\begin{block}{PIBS tool}
|
|
pibs -r source.cap.gz -w backscatter.cap
|
|
\end{block}
|
|
\end{frame}
|
|
\end{document}
|