


%1. Restate the Research Problem or Objective (1-2 paragraphs)
%Briefly remind the reader of the central research question or objective of your thesis.

This thesis set out to propose an artificial intelligence approach to the recognition of Denial of Service attacks in the digital forensic environment. 

Thanks to the fast technological advance and the development of an ultra connected world, remarkable improvement has been brought in various sectors. The role of the digital forensic became rapidly essential, because the growths of the technology was accompanied by a parallel evolution of the cybercrime. An important contribution to the cybercrime comes from the DoS attacks. A denial of service attack aims to disrupt the normal functioning of its victim, typically flooding it of illegitimate requests, making it inaccessible to legitimate users. One of the major challenges in combatting the DoS attacks is the difficulty in their detection. Many techniques, in fact, can be used to blend in their traces with legitimate traffic. As an example, can be used the IP spoofing or botnets to keep the attacker identity hidden, or varying randomly the request in order to make them similar to legitimate requests. Because of these reasons, the manual recognition of these attack, may be complex and time-consuming. The artificial intelligence approach, offers to the digital forensic science, a way to make this process automatic and quick. For this reason, this thesis has been based on the realisation of a system able to put the forensic process into practice and automatically recognise the DoS attacks by means of an AI model.




%2. Summarize Key Findings (2-3 paragraphs)
%Highlight the most significant findings of your research.
%Focus on how these findings address the research problem or objective.
The AI model resulted to be effective in the recognition of most of the DoS attacks tested. Specifically, it detected the presence of the attacks that were collected in the original database (CIC-IDS2017): Slowloris, slow HTTP POST, slow read, range header, HTTP flood. The attacks SYN flood, ICMP flood and Ping of Death can not be detected by the model because they are not present in the database and because of the way data are collected. The results obtained, highlight the advantages and limits of the AI, offering an automated and quick solution that does not require the human intervention.

%3. Discuss the Implications (2-3 paragraphs)
%Explain the importance of your findings.
%Discuss how they contribute to the existing body of knowledge in your field.
%Highlight any practical applications or policy implications.
The realisation of the virtual network offers the possibility to test the experiment in a safe and isolated environment, even to not highly specialised users. The system of log collection allows the automatic collection of the network logs, and an eventual add of a server would be automatically managed. The AI model allows the user to immediately detect the DoS attack in a vast and huge amount of data.

%4. Reflect on the Methodology (1 paragraph)
%Briefly review the methodology used.
%Discuss how it was appropriate for addressing the research problem and any limitations it might have had.
The virtual network has been realised by means of Docker, specifically with the tool docker-compose. In the network context, the routing matter was managed by FRRouting and the log collector by Fluentd. The last one is essential for the collection of both the entire network's logs and the data required for the DoS detection. Afterwards, an AI model, based on MultiLayer Perceptrons algorithm has been realised. It has been confronted with a baseline structured with a more classic machine learning algorithm, called Random Forest. Both the models have been trained on a dataset coming from a previous project, based on the dataset offered by the CIC of the 2017. Once the model has been trained and tested, it has been assembled in the virtual network, in the log collection management system. The model, in fact, could be used both to prepare live analysis of the data or to analyse single entry or entire logs. The data collection of the metrics interested for the DoS detection, happened by means of 2 eBPF tools: tcpLife and tcpTracer.

%5. Address the Research Questions/Hypotheses (1 paragraph)
%Explicitly state whether your research questions were answered or hypotheses were supported.
%6. Acknowledge Limitations (1-2 paragraphs)
%Discuss any limitations or weaknesses in your study.
%Explain how these limitations might affect the interpretation of the results.
The major limitations of the project raised with the analysis of the SYN flood, ICMP flood and Ping of Death attacks. If it is true that these attacks have not been performed during the building of the dataset, making their detection impossible, it is also verifiable that the metrics considered can not take care of these attacks. In fact, the typical half-opened connections of the SYN flood attacks, are never counted among the opened connections, because the tool tcpTracer increments the counter when the connection is successful. Considering the ICMP attacks instead, they have no effect on the metrics because no TCP connection gets established.



%7. Suggest Recommendations (1-2 paragraphs)
%Provide recommendations based on your findings.
%These can be practical recommendations or suggestions for future research.
%8. Future Research Directions (1-2 paragraphs)
%Suggest areas for further research that could build on your work.
%Highlight unanswered questions or new questions that %emerged from your research.
A possible solution, could be the aggregation of further AI models, trained on different data and fed with metrics that take care of half opened connections and ICMP packets.
Additional improvements may be gained employing the newer database offered by the Canadian Institute of Cybersecurity created in the 2019, that contains many other attacks, included the SYN flood attack.
Another possibility, may be trying to build a different database, collecting data one step ahead, in the routers' node. Trying to cut in advance the malicious traffic in an intrusion detection optic.
%Further developments: adding of other AI models, improvement of the model with a newer dataset,NO merging of the tcptools, build the dataset over the router (trying to understand one step in advance if an attack is happening).


%9. Final Thoughts (1 paragraph)
%End with a strong closing statement.
%Reflect on the overall significance of your work and its contribution to your field.

This project makes a significant contribution to the field of network security by demonstrating the potential of artificial intelligence models, in accurately recognizing and identifying specific types of Denial of Service attacks, offering a sensitive value in the forensic analysis environment. Moreover, the implementation of a virtual network using Docker emphasizes the practical and educational utility of the developed system. This approach not only offers a robust platform for real-world applications but also serves as a valuable resource for academic laboratories, enhancing both hands-on learning and theoretical understanding in the realm of network security.