Cyber Security and Analytics (MN623) Assignment Help

Assignment Description 

The assignment has two parts. 

Part I: Group Report 

Part II: Video Demonstration 

Submission Guidelines: 

1) Write a group report on the topics listed in Part I. 

2) Make a group video demonstration of three cyber security tools implemented for writing a  group report. 

3) Length of Video: The total length of the video presentation should not be more than 9  minutes (marks would be deducted for longer presentation). 

Note: Put the video link of your group video demonstration in the cover page of your Group Report. 

                   Part I – Finding Cyber Vulnerabilities (70 Marks) 

Complete the questions below after implementation (Take screenshots of your implemented work and include commentary for each screenshot) and make a report based on the following. You will be working  with applications in vulnerable_vm (metasploitable2, DVWA, mutillidae, OWASP BWA virtual machine) and if required, may use OWASP Mantra, as the web browser to perform the tests. Metasploitable is a  vulnerable virtual machine intended for practicing taking over machines. Damn Vulnerable Web App (DVWA)  is a PHP/MySQL web application that is damn vulnerable. The app is divided into sections for different  types of vulnerabilities. The best thing about DVWA is it has lessons/guidelines on how to exploit a 

vulnerability. Open Web Application Security Project (OWASP) Mutillidae is a free, open-source,  deliberately vulnerable web application providing a target for web-security training. With dozens of  vulnerabilities and hints to help the user; this is an easy-to-use web hacking environment designed for  labs, security enthusiast, classrooms, CTF, and vulnerability assessment tool targets. OWASP Broken Web  Applications Project, a collection of vulnerable web applications. Contents must include all the points: 

1. How can the Hackbar add-on be utilized to streamline parameter probing during security  assessments? (Demonstrate using SQL injection vulnerability in DVWA) 

2. What role does the Tamper Data add-on play in intercepting and modifying requests for  enhanced security testing? (Demonstrate using DVWA) 

3. How does ZAP facilitate the viewing and alteration of requests to identify potential  vulnerabilities? (Demonstrate using mutillidae)

4. What are the capabilities of Burp Suite in viewing and altering requests, and how does it  contribute to security assessments? (Demonstrate using mutillidae) 

5. What techniques are employed in identifying cross-site scripting (XSS) vulnerabilities during  security evaluations? (Demonstrate using DVWA) 

6. How can error-based SQL injection vulnerabilities be identified and mitigated during security  assessments? (Demonstrate using DVWA) 

7. What methods are utilized to detect blind SQL injection vulnerabilities, and what are the  associated risks? (Demonstrate using DVWA) 

8. How are vulnerabilities in cookies identified and addressed to enhance web application  security? (Demonstrate using mutillidae) 

9. What information can be obtained about SSL and TLS configurations using SSLScan, and how  does it contribute to security assessments? (Demonstrate using BWA – Download from link – https://sourceforge.net/projects/owaspbwa/) 

10. What approaches are employed in searching for file inclusions as part of security  evaluations? (Demonstrate using DVWA) 

11. How is the POODLE vulnerability identified and mitigated to enhance the security posture of  web applications? (Download Link- https://nmap.org/nsedoc/scripts/ssl-poodle.html) 12. Suggest and report defenses against the cyber vulnerabilities implemented from point 1 to 11.  13. Demonstrate your data analytic skills on any three datasets available at:

14. Select any of the recently published data set available on the links mentioned below, a) https://www.stratosphereips.org/datasets-iot23 and load it to Weka tool preferably or tool of your choice, then select the features with rationale (external reference or your own reasoning). 

Evaluate and select the data analytic techniques for testing and apply one method of classification and demonstrate the following steps. 

i) Create training and testing data samples from dataset provided at a) or b) above

ii) Classify the network intrusion given at the sample data at a) or b) above 

iii) Evaluate the performance of intrusion detection using the available tools and technologies (e.g. confusion matrix).

1. Damasevicius, R., Venckauskas, A., Grigaliunas, S., Toldinas, J., Morkevicius, N., Aleliunas, T., & Smuikys,P. (2020).  LITNET-2020: An annotated real-world network flow dataset for network intrusion detection. Electronics, 9(5), 800. 2. Larriva-Novo, X., Villagrá, V. A., Vega-Barbas, M., Rivera, D., & Sanz Rodrigo, M. (2021). An IoT-FocusedIntrusion  

Detection System Approach Based on Preprocessing Characterization for Cybersecurity Datasets. Sensors, 21(2), 656. 

3. Tait, Kathryn-Ann, Jan Sher Khan, Fehaid Alqahtani, Awais Aziz Shah, Fadia Ali Khan, Mujeeb Ur Rehman,Wadii Boulila, and Jawad Ahmad. “Intrusion Detection using Machine Learning Techniques: An Experimental Comparison.” arXiv preprint arXiv:2105.13435 (2021). 

1. Make a group video demonstration of three cyber security tools implemented for writing a group report. Marks distribution for this section include marks for Implementation and Demonstration, Presentation Teamwork and Collaboration, Demo and Viva. 

Note: 

If you are using the dataset at a) for your research, please reference it as “Stratosphere Laboratory. A labeled dataset with malicious and benign IoT network traffic. January 22. Agustin Parmisano, Sebastian Garcia, Maria Jose Erquiaga. 

Students can find “IEEE-Reference-Guide.pdf” available in Assignments Folder after logging into your MOODLE account for referencing purposes. 

Spark Plus activity is mandatory for MN623 Assignment 3 as it is a group assignment.

Assignment 3