Objective

This project demonstrates the integration of OpenFlow SDN using the Ryu controller with Snort, a network intrusion detection system (NIDS), for mitigating Distributed Denial of Service (DDoS) attacks in a network environment. The project uses GNS3 to simulate the network topology and Ubuntu Server to host the Ryu controller and Snort NIDS. The goal is to showcase how SDN can dynamically detect and mitigate various types of network attacks, including ICMP, TCP, and UDP floods, using Ryu’s flow management and Snort’s attack detection capabilities.

Skills Learned

• Understanding of OpenFlow and SDN architecture.
• Configuring Ryu controller and integrating it with OpenFlow-enabled devices.
• Installing and configuring Snort as an Intrusion Detection System.
• Using GNS3 for creating and managing network simulations.
• Implementing dynamic network traffic control for DDoS mitigation.
• Working with network mirroring and monitoring traffic for attack detection.

Tools Used

• GNS3: For simulating the network topology with Cisco switches, routers, and virtual machines.
• Ryu Controller: For managing SDN flow tables and traffic routing.
• OpenvSwitch (OVS): For creating virtual switches and mirroring traffic to Snort.
• Snort: Network Intrusion Detection System (NIDS) used for detecting and alerting on DDoS attacks.
• Ubuntu Server: Hosting the Ryu controller, Snort, and other necessary components.
• Hping3: For simulating DDoS attacks in the network.

Steps

1. GNS3 Topology Setup

The GNS3 workspace was populated with the following devices:

• Four Cisco switches for the core network switches.
• One Cisco router for routing between networks.
• Ten host PCs connected to the switches for testing traffic generation.
• One OpenvSwitch (OVS) integrated into the topology to work with the Ryu controller.
• Ryu Controller running on an Ubuntu server, responsible for managing traffic and flows.
• Snort IDS installed on the Ubuntu server to monitor and analyze network traffic.

2. Configuring OpenvSwitch (OVS)

OpenvSwitch (OVS) was installed on the Ubuntu server and configured to act as the central switch in the SDN network. To enable OVS and establish communication with the Ryu controller, the following commands were used:

# Install OVS sudo apt install openvswitch-switch

# Start OVS service sudo service openvswitch-switch start

# Create a bridge and add the interface sudo ovs-vsctl add-br br0 sudo ovs-vsctl add-port br0 eth0

# Set up traffic mirroring for Snort ovs-vsctl -- --id=@p get port br0 -- --id=@mirror create mirror name=snort-mirror select-all=true output-port=@p -- -- set Bridge br0 mirrors=@mirror

# Link OVS to the Ryu controller sudo ovs-vsctl set-controller br0 tcp:192.168.234.236:6633

3. Ryu Controller Setup

Ryu was installed on the Ubuntu server using the following commands:

# Install necessary packages sudo apt update sudo apt install python3 python3-pip xterm iperf hping3 net-tools wireshark apache2-utils curl

# Install Ryu sudo pip3 install ryu

# Verify installation ryu-manager --version

# Run Ryu application ryu-manager ryu-app.py

4. Snort Installation and Configuration

Snort was installed and configured as follows:

# Install Snort sudo apt-get update sudo apt-get install snort

# Configure Snort to monitor traffic sudo snort -A console -c /etc/snort/snort.conf -i eth0

5. DDoS Attack Simulation with Hping3

To simulate DDoS attacks, the following commands were used:

ICMP Flood

hping3 --icmp --flood --rand-source <destination_ip>

TCP Flood

hping3 --flood -S --rand-source -p 80 <destination_ip>

UDP Flood

hping3 --udp --flood --rand-source -p 161 <destination_ip>

6. Integration of Ryu and Snort for DDoS Mitigation

1. Network Setup: Ryu controller and Snort are configured to work together on the same server.
2. Traffic Mirroring: OVS mirrors all network traffic to Snort for inspection.
3. Attack Detection: Snort analyzes the incoming traffic for known attack patterns (ICMP, TCP, UDP floods).
4. Alert Generation: Upon detection, Snort generates an alert and sends it to the Ryu controller.
5. Dynamic Flow Modification: Ryu receives the alert and modifies the network flow table to mitigate the attack by blocking or rerouting malicious packets.

7. Experiment Results

Various types of DDoS attacks were simulated. The integration of Snort and Ryu provided an effective mitigation strategy. Dynamic flow control enabled the SDN network to detect and block malicious traffic in real-time, ensuring the availability and security of the network.

Conclusion

This project showcases how OpenFlow SDN and Ryu controller, when integrated with Snort IDS, can effectively mitigate DDoS attacks. By dynamically adjusting traffic flows based on attack detection, the system can prevent network disruptions and maintain service continuity.

For any questions or further assistance for the python code, please contact me - 📧 Email: johnusiabulu@cipherknights.com .

Wireshark analysis in the network during DDOS attacks.

Wireshark analysis in the network after DDOS attacks mitigated.

Objective

The objective of this forensic investigation was to thoroughly examine digital evidence related to a criminal activity involving arson and fraud. The investigation focused on acquiring and analyzing data from multiple sources, including mobile phones, solid-state drives (SSDs), and USB sticks. This case aimed to uncover evidence that could help establish the involvement of individuals in planning and executing a fire at a storage facility, resulting in a fatality and an insurance fraud scheme.

This investigation was conducted in strict compliance with the Association of Chief Police Officers (ACPO) guidelines, ensuring proper evidence handling and integrity throughout the process.

Skills Learned

• Forensic Data Acquisition: Gained hands-on experience in acquiring data from various digital devices using industry-standard forensic tools.
• Digital Evidence Analysis: Developed proficiency in using forensic tools like FTK Imager and Autopsy to analyze file structures, recover deleted files, and identify crucial digital evidence.
• Password Cracking: Enhanced skills in password recovery techniques using tools like John the Ripper to decrypt encrypted files.
• Cryptographic Analysis: Applied knowledge of encryption and hashing algorithms to validate the integrity of evidence and uncover hidden data.
• Chain of Custody Management: Gained experience in maintaining the integrity of evidence by following strict procedures for data acquisition and handling.

Tools Used

• FTK Imager: A tool used for creating bit-for-bit forensic images of storage devices.
• Autopsy: Open-source software for analyzing forensic images, recovering deleted files, and examining file metadata.
• John the Ripper: A password cracking tool used to decrypt encrypted Word documents.
• Write Blocker: A hardware tool used to prevent accidental modification of evidence during the acquisition process.
• Kali Linux: A Linux distribution used for forensic investigations, particularly for running John the Ripper.

Steps

1. Crime Scene Visit

Objective: To secure the crime scene, identify potential evidence, and document the environment for analysis while adhering to ACPO guidelines.

• Documenting the Scene:

  • Photographed and recorded the layout of the crime scene, focusing on areas of interest, including the storage facility, suspect's workstation, and any devices or storage media found.
  • Collected physical evidence, including mobile phones, an SSD, a USB stick, and handwritten notes, following strict evidence handling protocols.

• Tagging Evidence:

  • Each piece of evidence was assigned a unique identifier and placed in evidence bags with tamper-proof seals.
  • A detailed log was created, noting the date, time, location, and description of each item collected.

• Transporting Evidence:

  • The collected evidence was securely transported to the forensic lab while maintaining a proper chain of custody to prevent contamination or tampering.

2. Data Acquisition

Objective: To acquire data from the SSD and USB stick while ensuring data integrity using FTK Imager and write blockers.

• Acquiring Data from the SSD:

  • Attached the SSD to the write blocker to prevent data modification during the acquisition.
  • Connected the SSD to the computer and used FTK Imager to create a bit-for-bit image of the drive.
  • The forensic image was saved in the E01 format and hash values (MD5, SHA-1) were generated to verify data integrity.

• Acquiring Data from the USB Stick:

  • Similar procedure was followed for the USB stick using FTK Imager.
  • A forensic image of the USB drive was created and stored in a separate folder with appropriate hash values to verify its integrity.

3. Data Analysis

Objective: To analyze the forensic images from the SSD and USB stick using Autopsy and recover relevant evidence.

• Loading Forensic Images into Autopsy:

  • Opened Autopsy on the analysis workstation and created a new case for the investigation.
  • Added the forensic image files (E01) of the SSD and USB stick as data sources in Autopsy.

• Examination of SSD Files:

  • After ingestion, Autopsy was used to browse the file system on the SSD. I found several relevant files in the "Bad Items" folder.
  • Notably, Word documents named Skype.exe, Order.docx, Task.docx, and Rob.docx were discovered, all of which were encrypted with passwords.

• Examination of USB Stick Files:

  • Similar analysis was conducted on the USB stick, where encrypted documents were found in the "Bad Items" folder.
  • These documents contained valuable evidence linking the suspects to the crime, including plans to carry out the arson.

4. Decrypting Encrypted Files

Objective: To decrypt the encrypted Word documents found on the SSD and USB drive.

• Using John the Ripper for Password Cracking:

  • The encrypted Word documents (Skype.exe, Order.docx, Task.docx, Rob.docx) were extracted and stored in a folder on Kali Linux.
  • John the Ripper was set up on a Kali Linux virtual machine to perform brute-force password cracking on the documents.

• Cracking the Passwords:

  • Using a wordlist (rockyou.txt), John the Ripper attempted to brute-force the passwords for the encrypted documents.
  • The process revealed the passwords, allowing access to the content of the documents, which contained critical communications and instructions for executing the crime.

5. Investigating Evidence

Objective: To analyze the decrypted documents and identify key evidence linking the suspects to the crime.

• Content Analysis of Rob.docx:

  • The document revealed instructions to turn off safety measures and spill fuel in the storage facility, which was part of the plan to set it on fire.

• Corroborating Evidence from the SSD:

  • The analysis of the SSD's email folder revealed communication between the suspects, confirming the planning of the arson and fraud.

6. Reporting and Chain of Custody

Objective: To compile findings into a forensic report while ensuring the integrity of the evidence.

• Creating the Final Report:
  • A detailed forensic report was generated, summarizing the findings from the SSD, USB stick, and decrypted documents.
  • All evidence was securely stored, and the chain of custody was meticulously documented to ensure the integrity of the evidence.

Conclusion

This forensic investigation successfully uncovered crucial evidence linking the suspects to the arson and fraud scheme. The skills and tools learned during this project can be applied to similar investigations and are valuable for anyone pursuing a career in digital forensics.

Client: Prousse Fashion
Location: United Kingdom
Industry: Fashion / E-Commerce

Prousse Fashion is a UK-based company specializing in African traditional clothing. They needed a modern, user-friendly e-commerce platform to connect with a global audience and showcase their vibrant, culturally rich fashion line.

I designed and developed a fully responsive e-commerce website tailored to their brand, offering a seamless and intuitive shopping experience. The site includes dynamic product listings, secure payment integration, and mobile optimization to ensure accessibility for all users.

In addition to development, I implemented SEO best practices to optimize the site for niche keywords related to African fashion. This resulted in increased search visibility, more organic traffic, and a stronger presence in a highly competitive market.

Key Highlights:

• Custom-built e-commerce platform with an easy-to-manage product inventory

• Mobile-friendly design, ensuring accessibility across all devices

• SEO optimization targeting African fashion keywords

• Improved organic search rankings and increased online visibility

• Ongoing maintenance and updates for security and inventory management

This project helped elevate Prousse Fashion’s online presence, drive sales, and build brand recognition on a global scale.

Client: UVC Legal
Location: United Kingdom
Industry: Legal Services / Immigration

UVC Legal is a trusted immigration advisory firm providing expert legal support for visa and employment-related matters. They needed a professional, user-friendly website to represent their services and build trust with clients navigating complex immigration processes.

I designed and developed a clean, responsive website that clearly communicates UVC Legal’s expertise and services. The layout and structure were carefully crafted to make it easy for potential clients to find the information they need and get in touch.

To increase online visibility, I implemented an SEO strategy targeting high-volume legal terms related to immigration and employment. This helped UVC Legal rank higher in search engine results, drawing in more traffic and qualified leads.

Key Highlights:

• Professionally designed website with clear service presentation

• Responsive, mobile-friendly layout for better user experience

• SEO optimization targeting immigration and visa-related keywords

• Improved search rankings and increased client inquiries

• Ongoing updates to reflect legal changes and evolving client needs

This project positioned UVC Legal as a credible authority in immigration law and helped them expand their client base through a stronger online presence.

Client: Toraja Spring Care Home
Location: United Kingdom
Industry: Health & Social Care

Toraja Spring Care Home offers professional and compassionate elderly care in the UK. They needed a modern, informative website to better communicate their services and connect with families looking for trusted care options.

I designed and developed a clean, user-friendly website that’s easy to navigate and accessible across all devices. My focus was on creating a welcoming digital space that reflects the warmth and reliability of the care they provide.

To help them reach more local families, I implemented tailored local SEO strategies, optimizing the website for elderly care-related search terms within their region. This improved their visibility in local search results, leading to a noticeable increase in client inquiries.

What I Delivered:

• Custom-built website with intuitive navigation

• Responsive design for all devices

• Local SEO optimization targeting care-related searches

• Clear service information and strong calls to action

• Ongoing support to keep the site updated and compliant

This project helped Toraja Spring strengthen their online presence, build trust with potential clients, and increase engagement with families seeking quality care services.

Client: You Express Services
Location: United Kingdom
Industry: Transportation / Car Hire

You Express Services is a UK-based company offering convenient car hire and drop-off services. They needed a reliable online platform to streamline bookings and improve customer experience.

I designed and developed a seamless, user-friendly website that allows customers to easily book car hire and drop-off services. The platform is fully responsive and optimized for speed and usability, making it simple for users to navigate and complete their bookings from any device.

To help boost their online presence, I implemented tailored local SEO strategies targeting car hire and transportation keywords specific to their service areas. This significantly improved their visibility in search engine results, attracting more local traffic and increasing client inquiries.

Key Highlights:

• Custom booking platform designed for ease of use

• Fully responsive and mobile-optimized interface

• Local SEO implementation for increased visibility in targeted regions

• Enhanced user experience leading to higher customer satisfaction

• Ongoing website support, including security, performance, and updates

This project helped You Express Services grow their online reach, improve customer engagement, and drive more business through their digital platform.

This project simulates a mobile phone forensics investigation and is intended purely for demonstration, practice, or research purposes in a controlled environment. Any resemblance to actual persons, living or dead, or actual events is purely coincidental. The data, tools, processes, and findings presented here are entirely fictional, and no real-world legal or ethical implications should be inferred from this simulation.

Key Points:

• Not for Educational Use: This project is not intended as a teaching resource or educational material. It is designed to simulate an investigative process for the purpose of practice and skill development.
• Fictional Data and Case: All data used in this simulation, including but not limited to device data, user profiles, and communication logs, are fabricated and do not reflect any real-world individual or event.
• Not a Real Investigation: The processes, tools, and methodologies shown are for illustrative purposes only and are not meant to replicate actual forensic investigation procedures used in real cases.
• Ethical Use: The tools and methods demonstrated should only be used in compliance with legal and ethical standards, and only by authorized personnel in legitimate investigative contexts.

Project Overview

This project simulates a forensic investigation of a mobile phone to demonstrate the process of extracting and analyzing digital evidence. The primary focus is on mobile device forensics, the use of forensics tools like Cellebrite, and the examination of user data such as messages, call logs, photos, and more.

Objective

The objective of this project is to showcase how forensic investigators can extract, analyze, and present data from a mobile device in a simulated investigation. Key areas covered include:

• Extraction of mobile device data using forensic tools.
• Analysis of digital evidence from the mobile device.
• Creation of a detailed report based on the findings.
• Presentation of evidence that can be used in a simulated legal scenario.

Tools Used

• Cellebrite UFED: A tool used for extracting data from mobile devices.
• Cellebrite Analyzer: A tool for analyzing and interpreting extracted mobile data.
• iPhone 6s: A test mobile device used in this project (fictional data).

Skills Learned

• Understanding the process of mobile device data extraction.
• Analyzing digital evidence from mobile devices.
• Utilizing forensic software tools such as Cellebrite UFED and Analyzer.
• Creating detailed forensic reports based on the evidence found.

Steps

1. Mobile Device Identification and Data Extraction

In this step, the mobile device was identified and connected to the forensic tool (Cellebrite UFED). The tool extracted data including call logs, text messages, and multimedia files.

The device’s operating system, model, and serial number were captured for documentation.

The extraction process captured data from various app sources, including SMS, WhatsApp, and photos.

2. Data Analysis Using Cellebrite Analyzer

After the data was successfully extracted, it was imported into Cellebrite Analyzer for further examination. In this stage, we identified key pieces of evidence such as chat logs and timestamps.

Here, you can see the data from WhatsApp chat logs and photos being imported and parsed.

The analyzer provides a detailed view of the extracted messages, contacts, and multimedia files.

3. Expert Opinion and Findings

The forensic analysis revealed several important findings, including the identification of specific communication patterns that could indicate criminal activity. The metadata analysis of the photos also revealed timestamps that were crucial to the investigation.

This document contains a summary of the expert’s analysis and the significance of the findings.

4. Reporting and Documentation

The final step involved compiling all findings into a detailed report, summarizing the methods used, evidence collected, and the conclusions drawn from the analysis.

The report includes an executive summary, the methodology used, and a detailed description of all extracted data and findings.

Conclusion

This project demonstrates the key stages of a mobile phone forensic investigation, from data extraction to analysis and reporting. While this project is entirely fictional and for demonstration purposes, it showcases the capabilities of forensic tools and the importance of proper documentation and ethical practices in real forensic investigations.

Important Note

• Fictional Data: All the data used in this project, including text messages, photos, and call logs, are fabricated and do not belong to any real individual.
• No Real-Life Application: This project does not represent an actual criminal investigation. The processes and findings are used solely to illustrate the capabilities of forensic tools and techniques in a controlled, simulated environment.
• Ethical Guidelines: In real-world forensic investigations, it is crucial to follow all legal and ethical guidelines. This includes obtaining proper consent, following the law, and maintaining the privacy and security of all involved parties.

Legal Disclaimer

This project is for demonstration purposes only and does not involve real individuals, real data, or real-world legal proceedings. Any use of forensic tools and methods should only be done by certified professionals and in accordance with applicable laws and ethical standards.

Client: Church Of Salvation Okeigbala
Location: United Kingdom
Industry: Faith / Community

Church Of Salvation Okeigbala needed a welcoming and informative website to help them connect with their congregation and reach new members in their community. Their goal was to create an online space where people could easily access church information, stay updated on events, and engage more deeply with their faith.

I designed and developed a responsive, easy-to-navigate website that reflects the spirit and mission of the church. The platform allows visitors to view sermons, get event updates, and make online donations—all with a few simple clicks.

To improve discoverability, I implemented local SEO strategies to ensure the church ranks well for searches related to faith communities in their area. This helped boost their visibility online and made it easier for people to find and connect with them.

Key Highlights:

• Clean, accessible website tailored for community engagement

• Integration of sermon uploads, events calendar, and online giving

• Local SEO implementation to increase visibility in regional search results

• Increased engagement and easier access for church members

• Ongoing support and updates to keep content fresh and the site fully functional

This project helped Church Of Salvation Okeigbala strengthen their digital presence and better serve their growing community both online and offline.

Client: Opulenta Suites
Location: United Kingdom
Industry: Hospitality / Short-Term Rentals

Opulenta Suites offers high-end, short-term rental accommodations and needed a polished, user-friendly website to support direct bookings and enhance their brand presence. Their goal was to simplify the booking experience while appealing to a clientele looking for luxury stays.

I designed and developed a sleek, fully responsive booking platform that allows guests to easily browse listings, view amenities, and reserve accommodations directly from the site. The design reflects the premium feel of the brand while ensuring ease of use across all devices.

To drive more visibility, I implemented an SEO strategy focused on luxury short-term rental keywords, which helped improve the site’s rankings and increase organic traffic.

Key Highlights:

• Custom booking platform tailored for luxury short-term rentals

• Seamless user experience with a mobile-first design

• SEO optimization targeting luxury travel and Airbnb-style keywords

• Streamlined booking process that boosted conversions

• Ongoing maintenance to ensure smooth performance and updates

This project elevated Opulenta Suites’ online presence, attracted more qualified leads, and provided guests with a convenient way to book premium stays.

Client: HICMK Cleaning Services
Location: United Kingdom
Industry: Cleaning / Residential & Commercial Services

HICMK Cleaning Services is a trusted provider of residential and commercial cleaning solutions. They needed a professional and user-friendly website that clearly communicated their services and made it easy for customers to book appointments online.

I designed and developed a sleek, responsive website that showcases their service offerings, transparent pricing, and real customer testimonials. The platform includes a streamlined booking system, allowing clients to quickly schedule cleaning services with minimal hassle.

To attract more organic traffic, I built out detailed service pages and integrated an SEO-optimized blog targeting key phrases related to cleaning services, deep cleaning, and office sanitation. I also added a contact form and inquiry system to simplify communication and improve lead generation.

Key Highlights:

• Clean, responsive design tailored for service-based businesses

• Intuitive online booking system for residential and commercial cleaning

• SEO-focused content and blog to drive organic traffic

• Integrated contact and inquiry forms for better customer engagement

• Ongoing maintenance including updates, security, and SEO performance

This project helped position HICMK Cleaning Services as a reliable and accessible cleaning company, boosting their online visibility and increasing conversions through a modern, efficient digital platform.