Teaching Network Security through Signature Analysis of Computer Network Attacks

This paper presents an investigation of four categories of network attacks used in an intrusion detection and incident response graduate course; they are denial of service (DoS) attacks, probe attacks, user to root (U2R) attacks, and remote to local (R2L) attacks. In order to build an experimental network environment, virtualization technology is used. Two virtual machines are configured, one of which is used to launch attacks and the other acts as a victim host. A variety of network tools are installed for generation, collection and analysis of attack traffic traces. In each attack category, one real world attack is simulated; they are buffer overflow attack, TCP SYN scanning attack, backdoors attack, and guessing username and password attack. Finally, the attack traffic traces are analyzed and their attack signatures are extracted.