Chapter 1: Introduction to the study

1.1 Background to the Project

The background of this project is to develop a malicious packet analyzer …
The proposed system aims to overcome to ease the workload of security specialists or enthusiasts
alike of analyzing malicious traffic.

1.2 Problem Context

1.3 Rationale
The solution to the problem state above will be providing a user with malicious network file analyzer to
ease the analysis process. It will host a front end web based system to allow the users and organizations
to upload their network traffic file to feed the system. The system will then determine whether each
packet is malicious or not. This will greatly assist in the analysis of network traffic for users who just
been attacked or as a benchmark for their level of security.

1.4 Potential Benefits

1.4.1 Tangible Benefits
- A platform for users and organisations to analyze their network traffic
- Reduce the workload of security analysts on determining which packet is malicious
- Having a universal database of different kinds of network attack behaviors

1.4.2 Intangible Benefits

- Potentially being able to identify upcoming threats
- Avoid the loss of valuable information by being able to identify threats incoming into the
network

1.5 Target Users

The proposed system is expected to cater towards all users, security enthusiasts and organisations that
are interested of the malicious activity that are incoming and outgoing of their network.
1.6 Scope and Objectives
1.6.1 Aims
The project aims to develop a malicious packet file analyzer that can determine which packets are
malicious by detecting the incoming and outgoing bytes with the help of datasets.

1.6.2 Objectives
1. To inspect network packet files (pcap)
2. To identify malicious network packets from normal network packets.
3. To evaluate and design the system based on real world malicious traffic datasets.
4. To develop a web system to allow users to analyze their traffic activity.

1.6.3 Deliverables
The malicious packet analyzer (MPA) will be developed to ease the process of analysis.
The system will host a front-end and a back-end which will communicate with each other.

The backend server will host python as the development language for the proposed system. Besides, the
backend server will as well host machine learning algorithms like J48 trained with malicious datasets to
allow it to identify and discover any malicious packets in the network file. The algorithm determines
whether the packets are malicious or not based on multiple parameters, which includes incoming traffic,
outgoing traffic, type of service as well as the protocol
Chapter 2: Literature Review
2.1 Introduction
A

2.2 Domain Research

2.2.1 Machine Learning
2.2.2 Data Mining