Autoregeneration Of A Virtual Network From A Captured Traffic
The traffic that is flowing through the network can be captured and not only be utilized for identifying the fault in the network but can also be used to create a virtual network which can play a crucial role in the field of security. The creation of a virtual network from captured traffic can provide the analyst or researchers in the cyber domain to come with a low-cost implementation of the network in the virtualized form. This virtualized network can then be used to gather information about an attack that was carried out or gain knowledge about how the malware spread through the network. Using this knowledge gained the researcher can develop and test a solution to make the system more secure before implementing it on the real network. Since there is a lack of research in the field of regeneration of virtualized network from captured traffic, this project aims to provide a proof of concept of regeneration of network from captured traffic. To accomplish this task, a software was developed in PYTHON which would create the virtualized network by analyzing the Address Resolution Protocol (ARP), Internet Control Message Protocol (ICMP), User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) packets that are present in a captured traffic. The software that was developed was not able to recreate the network with complete accuracy in all the scenarios and needs to be developed further to create a robust solution for creating a virtualized network from captured traffic all of which has been discussed in the Future works chapter. By undertaking this research project, the researcher was able to identify that it is possible to create a fairly accurate virtualized network from captured traffic.
Computers have served with many of its advantages by allowing the user to perform different tasks over it. The era is strictly known for the computers, as every single instant has become a part of the digital life. The growing popularity of the computer systems and communication over lines create a concern of the security, the discussion of the security by the expert have led to a way of testingthe system or the complete network before we actually deploy it on the real life basis or in other hand we can say to allow a expert to take some measure to the systems, network or any single instant from getting attacked.
Traditionally packet captures have served the purpose of helping network engineers diagnose the fault that exists in the network and for the purpose of troubleshooting the network. One of the ways of effectively utilizing the captured traffic from a network that has been overlooked is for the regeneration of the network from the captured traffic. Currently, there is no open source of commercial software available that allows to utilize the captured traffic for regeneration of network. A software that can reproduce a virtual network from captured traffic will not only enable its users to diagnose faults or troubleshoot the network but can also potentially allow the user to detect anomalies that exist in the network. The concept of producing a virtual network from captured traffic can be an interesting aspect from the point of view of a security analyst or a researcher analyzing the behaviour of a malicious software on the network, as it can allow them to gain a more profound knowledge of how the network was behaving when an attack on the network was happening or to understand how a malicious software spread through the network. From a security point of view, this regenerated network can then be used to create solutions, which can be then tested on the regenerate network and analyze how effective is the solution that is implemented and how it affects the spread of an attack or a malware, before implementing the proposed solution on the actual network.
