6th European Conference - Academic Conferences

Vincent Garramone and Daniel Likarish
Course Topic Activity Description
Protocol Analysis After understanding packet
data structures. Examine
different types of network
services using standard
sniffing tools
Metadata and Statistical
Analysis
Session Data, Intrusion
Detection and Alert Data
Normal, Suspicious and
Malicious Traffic
References
Decompose packets for
the content: metadata and
other attributes using
packet capture files
Investigate layer three and
four session data using the
Network Security
Management Framework
Examples of normal,
suspicious and malicious
traffic based on pcap files
Example of a granular
Lab Activity
Explain the following
tcpdump flags: -v, -n, -
i, -r, -w, -e, -t, -x, -X, -
s, -D, -q, -L, identity
which flags that can
be used more than
once? Please use
7.pcap file for this
exercise.
Examine the files
1.pcap through 6.pcap
using either Netdude
or Wireshark
explaining what
protocols are in use,
whether they use UDP
or TCP and what ports
are used for each
protocol.
Please review the
nfsen video to review
the capabilities of
nfsen (a web front
end) and nfdump, the
netflow
collector/provider
Please examine pcap
files 1-7 and identify
the type of traffic and
whether or not it would
be normal, suspicious
or malicious.
PRISM Forensics
vocabulary
Network Forensics, Live
Systems Forensics
Log Analysis, Hidden
Data Discovery
Log Analysis, Hidden
Data Discovery
Malware Detection, Live
Systems Forensics,
Hidden Data Discovery
Bem, D. and Huebner, E. (2008) “Computer forensics workshop for undergraduate students”, In Proceedings of
the tenth conference on Australasian computing education, Vol. 78, Simon Hamilton and Margaret Hamilton
(Eds.), Australian Computer Society, Inc., Darlinghurst, Australia, pp 29-33.
Berghel, H. (2003) “The discipline of Internet forensics”, Communications of the ACM, Vol. 46, No. 8, pp 15-20.
DOI= http://doi.acm.org/10.1145/859670.859687
Cooper, S., Nickell, C., Piotrowski, V., Oldfield, B., Abdallah, A., Bishop, M., Caelli, B., Dark, M., Hawthorne, E.,
Hoffman, L., Perez, L., Pfleeger, C., Raines, R., Schou, C., and Brynielsson, J. (2010) “An exploration of the
current state of information assurance education”, SIGCSE Bull, Vol. 41, No. 4, pp 109-125.
DOI=10.1145/1709424.1709457
Crowley, E. (2007) “Corporate forensics class design with open source tools and live CDS”, J. Comput. Small
Coll. Vol. 22, No. 4, pp 170-176.
Davis, H., Carr, L., Hey, J., Howard, Y., Millard, D., Morris, D., and White, S. (2010) “Bootstrapping a culture of
sharing to facilitate open educational resources”, IEEE Transactions on Learning Technologies, Vol. 3, No.
2, pp 96-109.
Dicheva, D. and Dichev, C. (2006) “Tm4l: creating and browsing educational topic maps”, British Journal of
Educational Technology, Vol. 37, No. 3, pp 391-404.
Figg, W. and Zhou, Z. (2007) “A computer forensics minor curriculum proposal”, J. Comput. Small Coll, Vol. 22,
No. 4, pp 32-38.
Francia, G. A. (2006) “Digital forensics laboratory projects”, J. Comput. Small Coll, Vol. 21, No. 5, pp 38-44.
Garramone, V. and Schweitzer, D. (2010) “PRISM: A public repository for information security material”, In
Proceedings from the 14th Annual Colloquium for Information Systems Security Education, Baltimore, MD.
Irvine, C., Chin, S., and Frincke, D. (1998) “Integrating security into the curriculum”, Computer, Vol. 31, No. 12,
pp 25-30.
Moisey, S. Alley, M. & Spencer, B. (2006) “Factors affecting the development and use of learning objects”, The
American Journal of Distance Education, Vol. 20, No. 3, pp 143-161.
Null, L. (2004) “Integrating security across the computer science curriculum”, Journal of Computing Sciences in
Colleges, Vol. 19, No. 5, pp 170-178.
Peisert, S., Bishop, M., and Marzullo, K. (2008) “Computer forensics in forensics”, SIGOPS Oper. Syst. Rev., Vol.
42, No. 3, pp 112-122. DOI= http://doi.acm.org/10.1145/1368506.1368521
82