Objective

This project demonstrates the integration of OpenFlow SDN using the Ryu controller with Snort, a network intrusion detection system (NIDS), for mitigating Distributed Denial of Service (DDoS) attacks in a network environment. The project uses GNS3 to simulate the network topology and Ubuntu Server to host the Ryu controller and Snort NIDS. The goal is to showcase how SDN can dynamically detect and mitigate various types of network attacks, including ICMP, TCP, and UDP floods, using Ryu’s flow management and Snort’s attack detection capabilities.

Skills Learned

• Understanding of OpenFlow and SDN architecture.
• Configuring Ryu controller and integrating it with OpenFlow-enabled devices.
• Installing and configuring Snort as an Intrusion Detection System.
• Using GNS3 for creating and managing network simulations.
• Implementing dynamic network traffic control for DDoS mitigation.
• Working with network mirroring and monitoring traffic for attack detection.

Tools Used

• GNS3: For simulating the network topology with Cisco switches, routers, and virtual machines.
• Ryu Controller: For managing SDN flow tables and traffic routing.
• OpenvSwitch (OVS): For creating virtual switches and mirroring traffic to Snort.
• Snort: Network Intrusion Detection System (NIDS) used for detecting and alerting on DDoS attacks.
• Ubuntu Server: Hosting the Ryu controller, Snort, and other necessary components.
• Hping3: For simulating DDoS attacks in the network.

Steps

1. GNS3 Topology Setup

The GNS3 workspace was populated with the following devices:

• Four Cisco switches for the core network switches.
• One Cisco router for routing between networks.
• Ten host PCs connected to the switches for testing traffic generation.
• One OpenvSwitch (OVS) integrated into the topology to work with the Ryu controller.
• Ryu Controller running on an Ubuntu server, responsible for managing traffic and flows.
• Snort IDS installed on the Ubuntu server to monitor and analyze network traffic.

2. Configuring OpenvSwitch (OVS)

OpenvSwitch (OVS) was installed on the Ubuntu server and configured to act as the central switch in the SDN network. To enable OVS and establish communication with the Ryu controller, the following commands were used:

# Install OVS sudo apt install openvswitch-switch

# Start OVS service sudo service openvswitch-switch start

# Create a bridge and add the interface sudo ovs-vsctl add-br br0 sudo ovs-vsctl add-port br0 eth0

# Set up traffic mirroring for Snort ovs-vsctl -- --id=@p get port br0 -- --id=@mirror create mirror name=snort-mirror select-all=true output-port=@p -- -- set Bridge br0 mirrors=@mirror

# Link OVS to the Ryu controller sudo ovs-vsctl set-controller br0 tcp:192.168.234.236:6633

3. Ryu Controller Setup

Ryu was installed on the Ubuntu server using the following commands:

# Install necessary packages sudo apt update sudo apt install python3 python3-pip xterm iperf hping3 net-tools wireshark apache2-utils curl

# Install Ryu sudo pip3 install ryu

# Verify installation ryu-manager --version

# Run Ryu application ryu-manager ryu-app.py

4. Snort Installation and Configuration

Snort was installed and configured as follows:

# Install Snort sudo apt-get update sudo apt-get install snort

# Configure Snort to monitor traffic sudo snort -A console -c /etc/snort/snort.conf -i eth0

5. DDoS Attack Simulation with Hping3

To simulate DDoS attacks, the following commands were used:

ICMP Flood

hping3 --icmp --flood --rand-source <destination_ip>

TCP Flood

hping3 --flood -S --rand-source -p 80 <destination_ip>

UDP Flood

hping3 --udp --flood --rand-source -p 161 <destination_ip>

6. Integration of Ryu and Snort for DDoS Mitigation

1. Network Setup: Ryu controller and Snort are configured to work together on the same server.
2. Traffic Mirroring: OVS mirrors all network traffic to Snort for inspection.
3. Attack Detection: Snort analyzes the incoming traffic for known attack patterns (ICMP, TCP, UDP floods).
4. Alert Generation: Upon detection, Snort generates an alert and sends it to the Ryu controller.
5. Dynamic Flow Modification: Ryu receives the alert and modifies the network flow table to mitigate the attack by blocking or rerouting malicious packets.

7. Experiment Results

Various types of DDoS attacks were simulated. The integration of Snort and Ryu provided an effective mitigation strategy. Dynamic flow control enabled the SDN network to detect and block malicious traffic in real-time, ensuring the availability and security of the network.

Conclusion

This project showcases how OpenFlow SDN and Ryu controller, when integrated with Snort IDS, can effectively mitigate DDoS attacks. By dynamically adjusting traffic flows based on attack detection, the system can prevent network disruptions and maintain service continuity.

For any questions or further assistance for the python code, please contact me - 📧 Email: johnusiabulu@cipherknights.com .

Wireshark analysis in the network during DDOS attacks.

Wireshark analysis in the network after DDOS attacks mitigated.

Objective

The objective of this forensic investigation was to thoroughly examine digital evidence related to a criminal activity involving arson and fraud. The investigation focused on acquiring and analyzing data from multiple sources, including mobile phones, solid-state drives (SSDs), and USB sticks. This case aimed to uncover evidence that could help establish the involvement of individuals in planning and executing a fire at a storage facility, resulting in a fatality and an insurance fraud scheme.

This investigation was conducted in strict compliance with the Association of Chief Police Officers (ACPO) guidelines, ensuring proper evidence handling and integrity throughout the process.

Skills Learned

• Forensic Data Acquisition: Gained hands-on experience in acquiring data from various digital devices using industry-standard forensic tools.
• Digital Evidence Analysis: Developed proficiency in using forensic tools like FTK Imager and Autopsy to analyze file structures, recover deleted files, and identify crucial digital evidence.
• Password Cracking: Enhanced skills in password recovery techniques using tools like John the Ripper to decrypt encrypted files.
• Cryptographic Analysis: Applied knowledge of encryption and hashing algorithms to validate the integrity of evidence and uncover hidden data.
• Chain of Custody Management: Gained experience in maintaining the integrity of evidence by following strict procedures for data acquisition and handling.

Tools Used

• FTK Imager: A tool used for creating bit-for-bit forensic images of storage devices.
• Autopsy: Open-source software for analyzing forensic images, recovering deleted files, and examining file metadata.
• John the Ripper: A password cracking tool used to decrypt encrypted Word documents.
• Write Blocker: A hardware tool used to prevent accidental modification of evidence during the acquisition process.
• Kali Linux: A Linux distribution used for forensic investigations, particularly for running John the Ripper.

Steps

1. Crime Scene Visit

Objective: To secure the crime scene, identify potential evidence, and document the environment for analysis while adhering to ACPO guidelines.

• Documenting the Scene:

  • Photographed and recorded the layout of the crime scene, focusing on areas of interest, including the storage facility, suspect's workstation, and any devices or storage media found.
  • Collected physical evidence, including mobile phones, an SSD, a USB stick, and handwritten notes, following strict evidence handling protocols.

• Tagging Evidence:

  • Each piece of evidence was assigned a unique identifier and placed in evidence bags with tamper-proof seals.
  • A detailed log was created, noting the date, time, location, and description of each item collected.

• Transporting Evidence:

  • The collected evidence was securely transported to the forensic lab while maintaining a proper chain of custody to prevent contamination or tampering.

2. Data Acquisition

Objective: To acquire data from the SSD and USB stick while ensuring data integrity using FTK Imager and write blockers.

• Acquiring Data from the SSD:

  • Attached the SSD to the write blocker to prevent data modification during the acquisition.
  • Connected the SSD to the computer and used FTK Imager to create a bit-for-bit image of the drive.
  • The forensic image was saved in the E01 format and hash values (MD5, SHA-1) were generated to verify data integrity.

• Acquiring Data from the USB Stick:

  • Similar procedure was followed for the USB stick using FTK Imager.
  • A forensic image of the USB drive was created and stored in a separate folder with appropriate hash values to verify its integrity.

3. Data Analysis

Objective: To analyze the forensic images from the SSD and USB stick using Autopsy and recover relevant evidence.

• Loading Forensic Images into Autopsy:

  • Opened Autopsy on the analysis workstation and created a new case for the investigation.
  • Added the forensic image files (E01) of the SSD and USB stick as data sources in Autopsy.

• Examination of SSD Files:

  • After ingestion, Autopsy was used to browse the file system on the SSD. I found several relevant files in the "Bad Items" folder.
  • Notably, Word documents named Skype.exe, Order.docx, Task.docx, and Rob.docx were discovered, all of which were encrypted with passwords.

• Examination of USB Stick Files:

  • Similar analysis was conducted on the USB stick, where encrypted documents were found in the "Bad Items" folder.
  • These documents contained valuable evidence linking the suspects to the crime, including plans to carry out the arson.

4. Decrypting Encrypted Files

Objective: To decrypt the encrypted Word documents found on the SSD and USB drive.

• Using John the Ripper for Password Cracking:

  • The encrypted Word documents (Skype.exe, Order.docx, Task.docx, Rob.docx) were extracted and stored in a folder on Kali Linux.
  • John the Ripper was set up on a Kali Linux virtual machine to perform brute-force password cracking on the documents.

• Cracking the Passwords:

  • Using a wordlist (rockyou.txt), John the Ripper attempted to brute-force the passwords for the encrypted documents.
  • The process revealed the passwords, allowing access to the content of the documents, which contained critical communications and instructions for executing the crime.

5. Investigating Evidence

Objective: To analyze the decrypted documents and identify key evidence linking the suspects to the crime.

• Content Analysis of Rob.docx:

  • The document revealed instructions to turn off safety measures and spill fuel in the storage facility, which was part of the plan to set it on fire.

• Corroborating Evidence from the SSD:

  • The analysis of the SSD's email folder revealed communication between the suspects, confirming the planning of the arson and fraud.

6. Reporting and Chain of Custody

Objective: To compile findings into a forensic report while ensuring the integrity of the evidence.

• Creating the Final Report:
  • A detailed forensic report was generated, summarizing the findings from the SSD, USB stick, and decrypted documents.
  • All evidence was securely stored, and the chain of custody was meticulously documented to ensure the integrity of the evidence.

Conclusion

This forensic investigation successfully uncovered crucial evidence linking the suspects to the arson and fraud scheme. The skills and tools learned during this project can be applied to similar investigations and are valuable for anyone pursuing a career in digital forensics.

Client: Prousse Fashion
Location: United Kingdom
Industry: Fashion / E-Commerce

Prousse Fashion is a UK-based company specializing in African traditional clothing. They needed a modern, user-friendly e-commerce platform to connect with a global audience and showcase their vibrant, culturally rich fashion line.

I designed and developed a fully responsive e-commerce website tailored to their brand, offering a seamless and intuitive shopping experience. The site includes dynamic product listings, secure payment integration, and mobile optimization to ensure accessibility for all users.

In addition to development, I implemented SEO best practices to optimize the site for niche keywords related to African fashion. This resulted in increased search visibility, more organic traffic, and a stronger presence in a highly competitive market.

Key Highlights:

• Custom-built e-commerce platform with an easy-to-manage product inventory

• Mobile-friendly design, ensuring accessibility across all devices

• SEO optimization targeting African fashion keywords

• Improved organic search rankings and increased online visibility

• Ongoing maintenance and updates for security and inventory management

This project helped elevate Prousse Fashion’s online presence, drive sales, and build brand recognition on a global scale.