ASSIGNMENT-2 Q3 (Course Name- Cyber Security) (Course Code - PUMC-207)

1. Fundamentals of Network Security

2. Network-Based Threats and Attack Types

• Passive Attacks (Eavesdropping & Monitoring):
  
  
  • Concept: In a passive attack, the malicious actor monitors, intercepts, or analyzes unencrypted network traffic without altering the data packets or affecting normal network operations. Because they do not disrupt the system, passive attacks are notoriously difficult to detect; they leave virtually no operational traces, system logs, or performance degradation.
    
    
  • Primary Goal: The objective is strictly information gathering. Attackers aim to steal sensitive credentials (like plaintext passwords), harvest corporate intellectual property, or conduct traffic analysis to map out the network's topology and communication patterns for a future active attack.
    
    
  • Examples:
    
    
    • Packet Sniffing: Attackers place a network interface card (NIC) into promiscuous mode and use tools like Wireshark or tcpdump to capture packets traversing an unencrypted Wi-Fi or wired network.
      
      
    • Traffic Analysis: Even if data is encrypted, attackers analyze the frequency, length, and origin/destination of messages to infer the nature of the communication.
      
      
• Active Attacks (Interruption, Modification & Fabrication):
  
  
  • Concept: Unlike passive threats, active attacks involve the attacker actively engaging with the network. They alter network communication, inject malicious or malformed traffic, impersonate legitimate network entities, or disable critical services entirely. Active attacks directly threaten the integrity and availability of network resources.
    
    
  • Primary Goal: These attacks are designed for system takeover, unauthorized data modification, data corruption, extortion (e.g., ransomware deployment), or total service disruption.
    
    
  • Examples: Man-in-the-Middle (MitM) attacks, Replay attacks (capturing legitimate traffic and fraudulently delaying or repeating it), and Denial of Service (DoS) attacks.
    
    

• Distributed Denial of Service (DDoS): A DDoS attack attempts to exhaust the resources of a target network, application, or service. Attackers hijack thousands of vulnerable IoT devices or computers (forming a "botnet") and direct them to flood target routers, firewalls, or web servers with overwhelming volumes of traffic (e.g., SYN floods, UDP floods), effectively crashing online services for legitimate users.
  
  
• Man-in-the-Middle (MitM) & ARP Poisoning: The attacker secretly positions themselves between two communicating nodes (such as a user and a corporate server). Using techniques like ARP Poisoning on a local area network (LAN), the attacker associates their MAC address with the IP address of the legitimate default gateway, allowing them to intercept, read, modify, and relay traffic seamlessly.
  
  
• IP and DNS Spoofing: In IP spoofing, attackers falsify the source IP address in the packet header to conceal their identity or impersonate a trusted machine to bypass IP-based authentication. DNS Cache Poisoning (DNS Spoofing) involves corrupting the Domain Name System cache so that when a user attempts to visit a legitimate website, the network resolves the domain to the IP address of a malicious server controlled by the attacker.
  
  
• Rogue Access Points & Evil Twin Attacks: Attackers set up unauthorized wireless access points physically close to a corporate environment. An "Evil Twin" mimics the legitimate corporate Wi-Fi SSID and MAC address. Unsuspecting employee devices automatically connect to the stronger, fake signal, allowing the attacker to capture login credentials and monitor all web traffic.
  
  

3. Essential Network Defense Infrastructure

• Packet-Filtering Firewalls: Operating at the Network and Transport layers (OSI Layers 3 and 4), these firewalls inspect individual packets based on source/destination IP addresses, protocols, and port numbers. They are fast but lack context, as they do not track the state of a connection.
  
  
• Stateful Inspection Firewalls: These devices maintain a state table, tracking the active connection states (such as the TCP 3-way handshake). They ensure that incoming packets are legitimate responses to outgoing requests established in an active session, offering better security than simple packet filters.
  
  
• Next-Generation Firewalls (NGFW): NGFWs combine traditional firewall capabilities with deep packet inspection (DPI) at the Application layer (OSI Layer 7). They integrate intrusion prevention, application-level control, encrypted traffic inspection, and real-time cloud threat intelligence to block sophisticated application-layer attacks.
  
  

• IDS (Intrusion Detection System): A passive, out-of-band monitoring system that analyzes copies of network traffic for malicious signatures or behavioral anomalies. It does not block traffic but generates alerts for security administrators (e.g., Snort).
  
  
• IPS (Intrusion Prevention System): An active, inline device positioned directly in the traffic path. When it detects a threat, it can automatically take action—such as blocking the source IP, dropping malicious packets, or resetting the TCP connection in real time.
  
  
• Detection Approaches:
  
  
  • Signature-Based: Compares network traffic payloads against a database of known threat signatures. It is highly effective against known malware but blind to new attacks.
    
    
  • Anomaly-Based: Establishes a baseline of normal network traffic using statistical modeling or machine learning. It flags deviations from this baseline, making it highly effective at catching zero-day (previously unknown) attacks, though it may produce false positives.
    
    

• Protocols: Industry-standard protocols include IPsec (Internet Protocol Security), OpenVPN, and WireGuard.
  
  
• Function: VPNs encrypt the data payload and mask the user's original IP address, ensuring data confidentiality and integrity. This is the cornerstone technology enabling secure remote work paradigms.
  
  

• Network Segmentation: This practice divides a large, flat computer network into smaller, isolated subnetworks (VLANs or micro-segments) using firewalls and access control lists (ACLs). If an attacker breaches one segment (e.g., a marketing workstation), segmentation limits "lateral movement," preventing them from freely accessing highly sensitive areas (e.g., PCI-DSS payment processing zones or HR databases).
  
  
• Zero Trust Architecture (ZTA): Moving away from perimeter-based security, ZTA operates on the fundamental principle of "Never Trust, Always Verify." In a Zero Trust network, no user, device, or application is inherently trusted, regardless of whether it is physically inside the corporate office or connecting remotely. Every connection request is strictly authenticated, authorized, and continuously validated for security posture before granting least-privilege access.
  
  

4. Role of Artificial Intelligence (AI) in Modern Network Security

• Behavioral Anomaly Detection (UEBA): AI algorithms excel at User and Entity Behavior Analytics (UEBA). They continuously analyze network telemetry to establish dynamic, highly granular baselines of "normal" behavior for every user and device. If an employee who normally downloads 50MB of files during business hours suddenly attempts to download 50GB of encrypted data to a foreign IP address at 3:00 AM, the AI immediately flags this anomaly, which static signature-based systems would completely miss.
  
  
• Zero-Day Threat Discovery: Threat actors constantly modify malware code to evade traditional antivirus software. Machine learning classification models can analyze unknown executable files, packet payloads, and URL structures in real-time sandboxes. By analyzing the behavior and features of the code rather than its signature, AI can detect and block unpatched zero-day exploits before a formal signature is even created.
  
  
• Automated Incident Response (SOAR Integration): Security Orchestration, Automation, and Response (SOAR) platforms integrate AI to execute automated response "playbooks." When a high-fidelity threat is detected, the AI can orchestrate an immediate response across multiple tools—such as isolating a compromised VLAN, blocking malicious IP addresses at the NGFW, and revoking user Active Directory credentials within milliseconds, drastically reducing the Mean Time to Respond (MTTR).
  
  
• Predictive Threat Intelligence: AI systems process millions of global security events, dark web indicators, and threat telemetry feeds daily. Using natural language processing and pattern recognition, AI can predict potential attack vectors, identify emerging botnet infrastructures, and automatically strengthen local network firewall policies proactively before an attack even targets the organization.
  
  

Conclusion