
The digital forensic is a branch of the forensic science that focuses on identifying, acquiring, processing, analysing and reporting on data stored electronically. During the course of this thesis it has been shown what the data in analysis were (node logs and TCP connections), how it has been acquired (by means of syslog-ng and the TCP tools), how it was collected (with Fluentd). Now it is time to explain how to analyse it.

\section{Model exportation and importation}
To be able to use the model, in an environment different from the one of its creation, it is necessary to export the model and the standardisation scaler. As explained in the chapter The Model, in order to facilitate the training of the model it is preferable to standardise the data, and later, to make the prediction coherent, standardise the data in the same way before testing them. To do so, it is necessary to use the function \cmd{dump()} of the library \cmd{joblib}, to serialise and save the scaler:

\begin{lstlisting}[language=Python]
from joblib import dump
dump(sc, 'std_scaler.bin', compress=True)
\end{lstlisting}

To export the model instead, it is just necessary to use the function \cmd{save()} of the \cmd{sequential} object \cmd{model}. A \cmd{sequential} object in Keras is a linear stack of layers, used to build a neural network by adding layers sequentially.
\begin{lstlisting}[language=Python]
model.save('MLP_11agosto.keras') 
\end{lstlisting}

In order to make use of the model, it is necessary to import both the scaler and the model. To do so, it is used the function \cmd{load()} of the library \cmd{joblib} for the scaler and the function \cmd{load\_model()} from the Keras module of TensorFlow library.

\begin{lstlisting}[language=Python]
classifierLoad = tf.keras.models.load_model( '/shared-volume/prediction/MLP_11agosto.keras', compile=False)

# Load the StandardScaler
scaler = joblib.load('/shared-volume/prediction/std_scaler.bin')
\end{lstlisting}

The compile parameter is set as false to indicate that the model is not going to be trained, but just fed with prediction entries.


\section{Data analysis}
To perform the analysis, it has been created three versions of the detection program: a live version and two version that take in input a log file or a single entry. Here it is a brief explanation of the programs.
\subsection{Live}
The live analysis happens, as introduced in the chapter The virtual network, thanks to Fluentd.
When the node admin-fluent match a line tagged as \cmd{dos.tracer.logs} \ref{lst:network-fluent.conf2}, it gets doubled in two branches. The second branch simply prints the lines in a \cmd{.log} file. The first branch stores temporarily the lines in a buffer, that is used as argument for the program \cmd{/shared-volume/prediction/ 1prediction.py}. The program, as the first step, imports the standard scaler and the DL model. Then it opens an output file, correspondent to the day the script is executed, tries to open the buffer file, that has received as first argument and process each line by extracting the values, scaling them and analysing with the model. Finally, it just prints the results by printing the log line, to make it easy to visualise and understand.
The line received by the program arrives as a JSON object in the following form:

\begin{lstlisting}[caption={Log line}]
{"TIME":"2024-06-28 17:05:43","IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
\end{lstlisting}

and it outputs in a file named as the current date in this form:

\begin{lstlisting}[caption={Log line}]
2024-06-28 17:07:09	{"TIME":"2024-06-28 17:05:43","IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
\end{lstlisting}

In which, the first argument is the time of analysis, the second is the JSON object sent by the Server, in which it is present the time of data extraction and the IP address of the sending node. The third is the result in terms of probability of recognition of a DoS attack or not. The fourth is a fast identification easy to read for the user, in which if the probability is under 0.2 it is considered as NO attack, if greater than 0.8 it is recognised as YES, and if in the middle as MAYBE.
\subsection{A posteriori}
The second way to analyse can happen by using the file .log, produced by the second branch of the Fluentd match, as input. The file is given as argument to the file, which will ask the interested time interval. If just one time is given, it will be considered as starting time and ending time. Finally, the results of the log contained in the time interval will be printed.

The third program, simply takes as input an entire single log line.

\section{Results}
In this paragraph, the results of the attacks' analysis will be shown. For a matter of simplicity, it will be exposed the results of the live analysis. 

\subsection{SlowHTTPtest}
The first attacks to be tested are related to the tool SlowHTTPtest, that allows, twitching its parameters, to perform several attacks. The description of the attack is in the previous chapter.

\subsubsection*{Slowloris}
Once the attack starts, the node gets flooded with these kinds of packets: 

\begin{lstlisting}
53    ksoftirqd/ ::ffff:10.100.0.2 3000  ::ffff:10.0.1.99 35410     0     0 63171.01
53    ksoftirqd/ ::ffff:10.100.0.2 3000  ::ffff:10.0.1.99 35402     0     0 63178.26
\end{lstlisting}

When the attack ends (\ref{fig:testslowloris}), it is possible to notice the effect it had on the network parameters and the results of the analysis.

\begin{lstlisting}
2024-06-30 16:32:45 {"TIME":"2024-06-30 18:32:07", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":64.36, "ms_var":0.0, "open_connections":2, "closed_connections":1, "mean_time":4.6335, "variance_time":64.08423425}
result: [[3.7544603e-05]]NO
2024-06-30 16:32:45 {"TIME":"2024-06-30 18:32:32", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":5.142499999999999, "ms_var":21.63334375, "open_connections":1008, "closed_connections":9, "mean_time":0.020617502458210424, "variance_time":0.03552934140457842}
result: [[1.]]YES
2024-06-30 16:34:01 {"TIME":"2024-06-30 18:32:57", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":6.652222222222223, "ms_var":228.9606839506173, "open_connections":9, "closed_connections":9, "mean_time":1.3333888888888887, "variance_time":2.203675015432099}
result: [[0.00063743]]NO
2024-06-30 16:34:01 {"TIME":"2024-06-30 18:33:22", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":66139.98070506456, "ms_var":34619827.50813724, "open_connections":7, "closed_connections":1007, "mean_time":0.018799802761341224, "variance_time":0.05370422323467509}
result: [[1.]]YES
2024-06-30 16:34:01 {"TIME":"2024-06-30 18:33:47", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/SlowSlowloris.png}
    \caption{SlowHTTPtest: Slowloris attack}
    \label{fig:testslowloris}
\end{figure}

As noticeable, the attack started at 18:32:08 (which is the time of ends minus the duration of the attack - 18:33:18 - 00:01:10. Observing the output of the analysis, it is possible to notice the output time on the left, and the record time in the JSON object. Studying the record time, it is possible to match the starting of the attack with the first recognition of the attack at 18:32:32 (second block). It's observable a hole of recognition at 18:32:57 and finally the recognition of the attack until its end at 18:33:18.

\subsubsection*{Slow HTTP POST}
Once the attack starts, the node gets flooded with these kinds of packets:

\begin{lstlisting}
14.272   X  23552  node             6  [::ffff:10.100.0.2] [::ffff:10.0.1.99] 3000   59070
23552 node       ::ffff:10.100.0.2 3000  ::ffff:10.0.1.99 59070     0     0 4.62
\end{lstlisting}

When the attack ends (\ref{fig:tesslowthttopost}), it is possible to notice the effect it had on the network parameters and the results of the analysis.

\begin{lstlisting}
2024-06-30 16:57:07 {"TIME": "2024-06-30 18:56:00", "IP address": "10.100.0.2", "tx_mean": 0, "rx_mean": 0, "tx_var": 0, "rx_var": 0, "ms_mean": 0, "ms_var": 0, "open_connections": 0, "closed_connections": 0, "mean_time": 0, "variance_time": 0}
result: [[0.0051403]]NO
2024-06-30 16:57:07 {"TIME": "2024-06-30 18:56:25", "IP address": "10.100.0.2", "tx_mean": 0.0, "rx_mean": 0.0, "tx_var": 0.0, "rx_var": 0.0, "ms_mean": 22.264, "ms_var": 366.7145840000001, "open_connections": 1558, "closed_connections": 5, "mean_time": 0.015962915601023014, "variance_time": 0.0945741520774327}
result: [[1.]]YES
2024-06-30 16:57:07 {"TIME": "2024-06-30 18:56:50", "IP address": "10.100.0.2", "tx_mean": 0.0, "rx_mean": 0.0, "tx_var": 0.0, "rx_var": 0.0, "ms_mean": 14.1925, "ms_var": 205.02084374999998, "open_connections": 1456, "closed_connections": 10, "mean_time": 0.01705525238744884, "variance_time": 0.022525492854404246}
result: [[1.]]YES
2024-06-30 16:58:23 {"TIME": "2024-06-30 18:57:15", "IP address": "10.100.0.2", "tx_mean": 0.0, "rx_mean": 0.0, "tx_var": 0.0, "rx_var": 0.0, "ms_mean": 37.57000000000001, "ms_var": 9295.806355555556, "open_connections": 9, "closed_connections": 9, "mean_time": 1.1668888888888889, "variance_time": 1.9667417654320987}
result: [[0.0007289]]NO
2024-06-30 16:58:23 {"TIME": "2024-06-30 18:57:40", "IP address": "10.100.0.2", "tx_mean": 0.0, "rx_mean": 0.0, "tx_var": 0.0, "rx_var": 0.0, "ms_mean": 66180.11147371923, "ms_var": 60698916.93106413, "open_connections": 6, "closed_connections": 3006, "mean_time": 0.005200531208499336, "variance_time": 0.015024671606623526}
result: [[1.]]YES
2024-06-30 16:58:23 {"TIME": "2024-06-30 18:58:05", "IP address": "10.100.0.2", "tx_mean": 0, "rx_mean": 0, "tx_var": 0, "rx_var": 0, "ms_mean": 0, "ms_var": 0, "open_connections": 0, "closed_connections": 0, "mean_time": 0, "variance_time": 0}
result: [[0.0051403]]NO
\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/SlowHTTPpost.png} 
    \caption{SlowHTTPtest: Slow HTTP POST attack}
    \label{fig:tesslowthttopost}
\end{figure}

As noticeable, the attack started at 18:57:13 (which is the time of ends minus the duration of the attack - 18:57:31 - 00:01:18. Observing the output of the analysis, it is possible to notice the output time on the left, and the record time in the JSON object. Studying the record time, it is possible to match the starting of the attack with the first recognition of the attack at 18:56:25 (second block). It's observable a hole of recognition at 18:57:15 and finally the recognition of the attack until its end at 18:57:31.

\subsubsection*{Slow read}
Once the attack starts, the node gets flooded with these kinds of packets:

\begin{lstlisting}
24.681   X  23552  node             6  [::ffff:10.100.0.2] [::ffff:10.0.1.99] 3000   39626
23552 node       ::ffff:10.100.0.2 3000  ::ffff:10.0.1.99 39636     0     0 400.97
\end{lstlisting}

When the attack ends (\ref{fig:testslowRead}), it is possible to notice the effect it had on the network parameters and the results of the analysis.

\begin{lstlisting}
2024-06-30 19:19:57 {"TIME":"2024-06-30 19:19:15", "IP address":"10.100.0.2", "tx_mean":110.75, "rx_mean":0.375, "tx_var":36796.6875, "rx_var":0.484375, "ms_mean":12.924999999999999, "ms_var":45.301, "open_connections":1732, "closed_connections":8, "mean_time":0.014363584147041931, "variance_time":0.034053624842754114}
result: [[1.3909139e-09]]NO
2024-06-30 19:19:57 {"TIME":"2024-06-30 19:19:40", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":11.786249999999999, "ms_var":2.0164484375000002, "open_connections":2739, "closed_connections":9, "mean_time":8.187772925764374e-05, "variance_time":0.22645298201510577}
result: [[1.]]YES
2024-06-30 19:21:12 {"TIME":"2024-06-30 19:20:07", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":32849.44751583393, "ms_var":349394553.2815286, "open_connections":2657, "closed_connections":7105, "mean_time":0.002497848801475108, "variance_time":1.7370052737638903e-05}
result: [[1.]]YES
2024-06-30 19:21:12 {"TIME":"2024-06-30 19:20:30", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO

\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/slowRead.png}
    \caption{SlowHTTPtest: Slow Read attack}
    \label{fig:testslowRead}
\end{figure}

As noticeable, the attack started at 18:18:59 (which is the time of ends minus the duration of the attack - 19:20:04 - 00:01:05. Observing the output of the analysis, it is possible to notice the output time on the left, and the record time in the JSON object. Studying the record time, it is possible to match the starting of the attack with the first recognition of the attack at 19:19:40 (second block). Finally, the recognition of the attack until its end at 19:29:04.


\subsubsection*{Range header}
Once the attack starts, the node gets flooded with these kinds of packets: 

\begin{lstlisting}
15.043   A  23552  node             6  [::ffff:10.100.0.2] [::ffff:10.0.1.99] 3000   34586 
23552 node       ::ffff:10.100.0.2 3000  ::ffff:10.0.1.99 34586     0    22 1.50
\end{lstlisting}

When the attack ends (\ref{fig:testRangeHeaders}), it is possible to notice the effect it had on the network parameters and the results of the analysis.

\begin{lstlisting}
2024-06-30 19:36:28 {"TIME":"2024-06-30 19:35:24", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 19:36:28 {"TIME":"2024-06-30 19:35:49", "IP address":"10.100.0.2", "tx_mean":21.08291708291708, "rx_mean":0.0, "tx_var":6.8033145675503315, "rx_var":0.0, "ms_mean":2.455324675324675, "ms_var":4.234467252228291, "open_connections":1002, "closed_connections":1001, "mean_time":0.007491017964071858, "variance_time":0.06062548445026112}
result: [[1.]]YES
2024-06-30 19:36:28 {"TIME":"2024-06-30 19:36:14", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/SlowrangeHeaders.png}
    \caption{SlowHTTPtest: Range Headers attack}
    \label{fig:testRangeHeaders}
\end{figure}

As noticeable, the attack started at 19:35:35 (which is the time of ends minus the duration of the attack - 19:35:39 - 00:00:04. Observing the output of the analysis, it is possible to notice the output time on the left, and the record time in the JSON object. Studying the record time, it is possible to match the starting of the attack with the first recognition of the attack at 19:35:49 (second block). It's observable normal traffic after the recognition of the attack until its end at 19:35:39.



\subsection{HULK}
In this paragraph will be shown the results obtained by testing the model with the two HULK tools presented in the previous chapter.

\subsubsection*{HULK by Barry Shteiman}
Once the attack starts \ref{fig:HULKBarryStart}, the node gets flooded with these kinds of packets: 

\begin{lstlisting}
23552 node       ::ffff:10.100.0.2 3000  ::ffff:10.0.1.99 57065     0     0 358.98
1.193    X  23552  node             6  [::ffff:10.100.0.2] [::ffff:10.0.1.99] 3000   45879
\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/HULKBarryStart.png}
    \caption{HULK: Barry Shteiman version beginning of the attack}
    \label{fig:HULKBarryStart}
\end{figure}

When the attack ends (\ref{fig:HULKBarryEnd}), it is possible to notice the effect it had on the network parameters and the results of the analysis.

\begin{lstlisting}
2024-06-30 21:02:12 {"TIME":"2024-06-30 21:01:36", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 21:02:12 {"TIME":"2024-06-30 21:02:01", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":312.4005717771794, "ms_var":29472.425023558124, "open_connections":24187, "closed_connections":23960, "mean_time":0.00043887596577220237, "variance_time":0.0003397340515071709}
result: [[1.]]YES
2024-06-30 21:03:29 {"TIME":"2024-06-30 21:02:26", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":448.6163454696394, "ms_var":92739.72715849569, "open_connections":16570, "closed_connections":16868, "mean_time":-2.5240744063639985e-05, "variance_time":0.018729410153023873}
result: [[1.]]YES
2024-06-30 21:03:29 {"TIME":"2024-06-30 21:02:51", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":413.2333242258652, "ms_var":78000.77978958703, "open_connections":798, "closed_connections":1091, "mean_time":0.0005934356802541028, "variance_time":2.6181887784198792e-06}
result: [[1.]]YES
2024-06-30 21:03:29 {"TIME":"2024-06-30 21:03:16", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 21:04:45 {"TIME":"2024-06-30 21:03:41", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":1, "mean_time":0.0, "variance_time":0.0}
result: [[0.00510207]]NO
\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/HULKBarryEnd.png}
    \caption{HULK: Barry Shteiman version, end of the attack}
    \label{fig:HULKBarryEnd}
\end{figure}

As noticeable from \ref{fig:HULKBarryStart}, the attack started at 21:01:39. Observing the output of the analysis, it is possible to notice the output time on the left, and the record time in the JSON object. Studying the record time, it is possible to match the starting of the attack with the first recognition of the attack at 21:02:01 (second block). Finally, the recognition of the attack until its end at 21:02:28. 

\subsubsection*{HULK-v3}
Now a tentative with the HULK-v3 tool, in which the attack is performed by 3 clients at the same time.

\begin{lstlisting}[language=Bash, caption=HULKv3 server command]
python3 HULK-v3/hulk_launcher.py server http://10.100.0.2:3000
\end{lstlisting}

\begin{lstlisting}[language=Bash, caption=HULKv3 client command]
python3 HULK-v3/hulk_launcher.py client -n 3
\end{lstlisting}

Once the attack starts \ref{fig:HULKv3clientStart}, the node gets flooded with these kinds of packets: 

\begin{lstlisting}
12.620   X  39289  node             6  [::ffff:10.100.0.2] [::ffff:10.0.1.99] 3000   55386 
39289 node       ::ffff:10.100.0.2 3000  ::ffff:10.0.1.99 55418     0     1 1896.36
\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/HULKv3clientStart.png}
    \caption{HULK: HULKv3 version beginning of the attack}
    \label{fig:HULKv3clientStart}
\end{figure}

When the attack ends at 22:06:50, it is possible to notice the effect it had on the network parameters and the results of the analysis. The URL become invalid, as observable by the output of the HULKserver (\ref{fig:HULKv3serverEnd}) and HULKclient (\ref{fig:HULKv3clientEnd}).

\begin{lstlisting}
2024-06-30 22:07:22 {"TIME":"2024-06-30 22:06:19", "IP address":"10.100.0.2", "tx_mean":443.0, "rx_mean":2.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":5.0, "ms_var":0.0, "open_connections":3, "closed_connections":1, "mean_time":0.02825, "variance_time":0.00043118750000000004}
result: [[3.3780534e-09]]NO
2024-06-30 22:07:22 {"TIME":"2024-06-30 22:06:44", "IP address":"10.100.0.2", "tx_mean":0.2994652406417112, "rx_mean":0.0, "tx_var":0.2097858102891132, "rx_var":0.0, "ms_mean":2137.916878342246, "ms_var":44028667.542354755, "open_connections":1503, "closed_connections":1503, "mean_time":0.004091060152874708, "variance_time":0.03189500932187373}
result: [[1.]]YES
2024-06-30 22:07:22 {"TIME":"2024-06-30 22:07:09", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":8790.22857142857, "ms_var":17956308.8921551, "open_connections":1, "closed_connections":7, "mean_time":1.561375, "variance_time":7.304095734375}
result: [[0.00044243]]NO
\end{lstlisting}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/HULKv3serverEnd.png} 
    \caption{HULK: HULKv3 version, side server, end of the attack}
    \label{fig:HULKv3serverEnd}
\end{figure}

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/HULKv3clientEnd.png}
    \caption{HULK: HULKv3 version, side client, end of the attack}
    \label{fig:HULKv3clientEnd}
\end{figure}

As noticeable from \ref{fig:HULKv3clientStart}, the attack started at 22:06:38. Observing the output of the analysis, it is possible to notice the output time on the left, and the record time in the JSON object. Studying the record time, it is possible to match the starting of the attack with the first recognition of the attack at 22:06:44 (second block). Finally, the recognition of the attack until its end at 22:06:50. 

\subsection{Hping3 and Ping Of Death}
From the analysis of the SYN Flood attack, ICMP Flood and the Ping of Death it will be possible to notice how the model results not prepared for this kind of attacks.
\subsubsection*{Hping3}
With the tool hping3, it is possible to perform the SYN flood attack and the ICMP flood.
The SYN flood attack started at 22:39:09 (\ref{fig:SYNflood}), however on the server node is not possible to notice any change
.
\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/SYNflood.png}
    \caption{Hping3: SYN Flood attack}
    \label{fig:SYNflood}
\end{figure}

As noticeable, for what concerns the forensic tool, the AI model does not recognise any DoS attack and no visible changes in the metrics are appreciable. 

\begin{lstlisting}
2024-06-30 22:40:00 {"TIME":"2024-06-30 22:38:55", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 22:40:00 {"TIME":"2024-06-30 22:39:20", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":1, "closed_connections":0, "mean_time":0.0, "variance_time":0.0}
result: [[0.00609942]]NO
2024-06-30 22:40:00 {"TIME":"2024-06-30 22:39:45", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 22:41:17 {"TIME":"2024-06-30 22:40:10", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 22:41:17 {"TIME":"2024-06-30 22:40:35", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 22:41:17 {"TIME":"2024-06-30 22:41:00", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
\end{lstlisting}

The reason why this may happen is ascribable to two reason.
The first one lays in the way the open connection are collected. Because of the eBPF function, responsible for the increment of the counter \cmd{open\_connection} (\ref{lst:tcpTracerConnectReturn}), the half-opened connections, typical of the SYN flood attack, can not be counted. The eBPF functions responsible, are attached to the system call \cmd{tcp\_v4\_connect} (\ref{lst:tcpTracerAttachmentPoints}).
The second reason lays in the way the original database from the Canadian institute for Cybersecurity has been build. In fact, the attack SYN flood has never been performed during the record, making its detection, by means of an AI model, impossible.

For the ICMP flood attack, the same results are obtained.
The ICMP flood attack started at 22:47:11 (\ref{fig:ICMPflood}), however on the server node is not possible to notice any change.

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/ICMPflood.png}
    \caption{Hping3: ICMP Flood attack}
    \label{fig:ICMPflood}
\end{figure}

As noticeable, for what concerns the forensic tool, the AI model does not recognise any DoS attack and no visible changes in the metrics are appreciable. 

\begin{lstlisting}
2024-06-30 22:48:11 {"TIME":"2024-06-30 22:47:04", "IP address":"10.100.0.2", "tx_mean":0.0, "rx_mean":0.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":79.03, "ms_var":0.0, "open_connections":1, "closed_connections":1, "mean_time":0.0205, "variance_time":0.00042025000000000005}
result: [[0.00525946]]NO
2024-06-30 22:48:11 {"TIME":"2024-06-30 22:47:29", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":1, "closed_connections":0, "mean_time":0.0, "variance_time":0.0}
result: [[0.00609942]]NO
2024-06-30 22:48:11 {"TIME":"2024-06-30 22:47:54", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 22:49:23 {"TIME":"2024-06-30 22:48:19", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 22:49:23 {"TIME":"2024-06-30 22:48:44", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":1, "mean_time":0.0, "variance_time":0.0}
result: [[0.00510207]]NO
2024-06-30 22:49:23 {"TIME":"2024-06-30 22:49:09", "IP address":"10.100.0.2", "tx_mean":443.0, "rx_mean":2.0, "tx_var":0.0, "rx_var":0.0, "ms_mean":2.0, "ms_var":0.0, "open_connections":1, "closed_connections":1, "mean_time":0.0175, "variance_time":0.00030625000000000004}
result: [[2.8753062e-09]]NO
\end{lstlisting}

The reason why this may happen is ascribable to two reason.
The first one lays in the way ICMP flood works. In fact, the ICMP is not involved in the TCP connections, so it is impossible for the metrics used to spot any change.
The second reason lays in the way the original database from the Canadian institute for Cybersecurity has been build. In fact, the attack ICMP flood has never been performed during the record, making its detection, by means of an AI model, impossible.

\subsubsection*{Ping of Death}
The Ping of Death attack started at 22:58:52 (\ref{fig:PoD}), however on the server node is not possible to notice any change.

\begin{figure}[h] % htbp stands for here, top, bottom, page (order of preference for placing the figure)
    \centering
    \includegraphics[width=0.7\textwidth]{7Results/PoD.png}
    \caption{Hping3: Ping of Death attack}
    \label{fig:PoD}
\end{figure}

As noticeable, for what concerns the forensic tool, the AI model does not recognise any DoS attack and no visible changes in the metrics are appreciable. 

\begin{lstlisting}
2024-06-30 22:59:22 {"TIME":"2024-06-30 22:58:19", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 22:59:22 {"TIME":"2024-06-30 22:58:44", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":2, "closed_connections":0, "mean_time":0.4676666666666667, "variance_time":0.4374242222222222}
result: [[0.0010368]]NO
2024-06-30 22:59:23 {"TIME":"2024-06-30 22:59:09", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 23:00:39 {"TIME":"2024-06-30 22:59:34", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 23:00:39 {"TIME":"2024-06-30 22:59:59", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
2024-06-30 23:00:39 {"TIME":"2024-06-30 23:00:24", "IP address":"10.100.0.2", "tx_mean":0, "rx_mean":0, "tx_var":0, "rx_var":0, "ms_mean":0, "ms_var":0, "open_connections":0, "closed_connections":0, "mean_time":0, "variance_time":0}
result: [[0.0051403]]NO
\end{lstlisting}

The reason why this may happen is ascribable to the same reasons of the ICMP flood attack treated in the previous paragraph.

\subsection{Node log example and TCP metrics data example}
In this paragraph are shown a couple of examples related to the log collection.

\begin{lstlisting}[caption={Node Log Entries}]
2024-06-30T13:43:30+00:00 fluent.info {"pid": 15, "ppid": 9, "worker": 0, "message": "starting fluentd worker pid=15 ppid=9 worker=0"}
2024-06-30T13:43:30+00:00 fluent.info {"message": "listening syslog socket on 0.0.0.0:5140 with tcp"}
2024-06-30T13:43:30+00:00 fluent.info {"port": 24224, "bind": "0.0.0.0", "message": "listening port port=24224 bind=\"0.0.0.0\""}
2024-06-30T13:43:30+00:00 fluent.info {"worker": 0, "message": "fluentd worker is now running worker=0"}
2024-06-30T13:43:00+00:00 routerD {"log": " * Starting system logging syslog-ng", "container_id": "9a8ecc7e0c1ebe749d242d74ed 773b9601efb4bc8fea0e000ca2031c38dea5e3", "container_name": "/newenvironment_rd_router_1", "source": "stdout"}
2024-06-30T13:43:03+00:00 routerD {"container_id": "9a8ecc7e0c1ebe749d242d74ed 773b9601efb4bc8fea0e000ca2031c38dea5e3", "container_name": "/newenvironment_rd_router_1", "source": "stderr", "log": "[2024-06-30T13:43:03.767144] WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.35 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.27'"}
\end{lstlisting}

\begin{lstlisting}[caption={TCP metrics data example}]
2024-06-30T15:56:53+00:00 dos.tracer.logs {"TIME": "2024-06-30 15:56:53", "IP address": "10.100.0.2", "tx_mean": 0.0, "rx_mean": 0.0, "tx_var": 0.0, "rx_var": 0.0, "ms_mean": 53.156666666666666, "ms_var": 2517.073088888889, "open_connections": 872, "closed_connections": 3, "mean_time": 0.006899428571428575, "variance_time": 4.813139591836732e-07}
2024-06-30T15:57:18+00:00 dos.tracer.logs {"TIME": "2024-06-30 15:57:18", "IP address": "10.100.0.2", "tx_mean": 0.0, "rx_mean": 0.0, "tx_var": 0.0, "rx_var": 0.0, "ms_mean": 15.74888888888889, "ms_var": 619.919698765432, "open_connections": 141, "closed_connections": 9, "mean_time": 0.1587019867549669, "variance_time": 0.3899703151616157}
\end{lstlisting}