Teaching Network Security With IP Darkspace Data

Abstract

This paper presents a network security laboratory project for teaching network traffic anomaly detection methods to electrical engineering students. The project design follows a research-oriented teaching principle, enabling students to make their own discoveries in real network traffic, using data captured from a large IP darkspace monitor operated at the University of California, San Diego (UCSD). Although darkspace traffic does not include bidirectional conversations (only attempts to initiate them), it contains traffic related to or actually perpetrating a variety of network attacks originating from millions of Internet addresses around the world. This breadth of coverage makes this darkspace data an excellent choice for a hands-on study of Internet attack detection techniques. In addition, darkspace data is less privacy-critical than other network traces, because it contains only unwanted network traffic and no legitimate communication. In the lab exercises presented, students learn about network security challenges, search for suspicious anomalies in network traffic, and gain experience in presenting and interpreting their own findings. They acquire not only security-specific technical skills but also general knowledge in statistical data analysis and data mining techniques. They are also encouraged to discover new phenomena in the data, which helps to ignite their general interest in science and engineering research. The Vienna University of Technology, Austria, first implemented this laboratory during the summer semester 2014, with a class of 41 students. With the help of the Center for Applied Internet Data Analysis (CAIDA) at UCSD, all exercises and IP darkspace data are publicly available.

Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range

“…The authors suggested a group-based strategy in which students have access to workstations that have the CommView network analysis and packet sniffing programs installed. A similar proposal, geared towards security auditing practice activities is proposed in [8], which presents a methodology for teaching network traffic anomaly detection techniques utilizing an IP darkspace monitor, resorting to the MATLAB, tcpdump, corsaro, and RapidMiner tools. They also present a concept for a network security laboratory, designed for instructional purposes.…”

Crowdsourcing Approach for Developing Hands-On Experiments in Cybersecurity Education

“…Instructor scored the accepted experimental works; the score was taken as the instantiation of Mark which ranged in [0,2]. The total score of each student taking part in crowdsourcing must range in [3], [5]. If the score exceeds 5, a certain amount of money would be paid to the student, which was the instantiation of Money.…”

“…these experiments from realistic scenarios that are shown to be more popular with the faculties and students [3].…”

Teaching the process of building an Intrusion Detection System using data from a small‐scale SCADA testbed

“…For understanding security auditing methods, Zseby et al 5 proposed a project for teaching network traffic anomaly detection methods using a large IP darkspace monitor operated at the University of California, San Diego (UCSD). The exercises are based on four software tools, including, tcpdump, corsaro, MATLAB, and RapidMiner.…”