


\begin{figure}[tbh]% per piazzare la tabella t:top b:bottom h:here, in ordine di preferenza; h è sconsigliato
The digital age, with a particular acceleration in the last years, has been characterised by a fast technological advance and the development of an ultra connected world, which has brought remarkable improvement in various sectors. Among these sectors, stand out the design and development of smart cities, the IoT world, electric vehicles field but also areas like finance, healthcare and E-commerce. However, parallel to this growth, there is the one of the cybercrime. The role of the digital forensic in this context become essential. The Interpol defines the digital forensic as ``a branch of forensic science that focuses on identifying, acquiring, processing, analysing, and reporting on data stored electronically'' \cite{Interpol2024}. As the cybercrime keep increasing its occurrence, the role of digital forensic become even more vital in detecting, mitigating and preventing the cyberattacks.

\centerline{\includegraphics[width=0.9\textwidth]{2DoSattacks/server-hourly-downtime-cost-2019.pdf}}
\caption{Estimated annual cost of cybercrime (source: \href{https://www.statista.com/chart/28878/expected-cost-of-cybercrime-until-2027/}{Statista}).\label{fig:downtimeCost}}
\end{figure}

The rise of the cybercrime brought with itself an important contribution of the Denial of Service attacks. The increasing frequency is attributed to the spread of availability of DDoS-for-hire services, also known as "booter" or "stresser" services, making a DoS attack incredibly easy even for unskilled people \cite{ClaytonKristoff2022}. Of course, the main accountable factor in growth is our, always increasing, reliance on the digital infrastructure. This instance, makes the understanding of the impact and the importance of DoS attack detection crucial.
Smart cities rely heavily on an interconnected system to manage and control urban infrastructure such as traffic lights, public transportation and public safety services. The advent of the 5G and Internet of Things encompasses a vast array of devices connected to the internet, making them a potential entry point for cybercriminals. In 2016, as an example, the Mirai botnet attack highlighted the vulnerabilities of the IoT devices that were used to launch a massive DDoS attack that disrupted major websites and internet services \cite{NJCCIC2016}. 

One of the major challenges in combatting DDoS attacks is the difficulty in recognizing them. These attacks, in fact, unlike the other cyberattacks that may leave clear traces, often blend in with legitimate traffic, making the detection complex. Attackers use various techniques such as IP spoofing and botnets to amplify their attack and to mask their origins. Moreover, the constant evolving of the technique increased the complexity, making the attacks more sophisticated and harder to detect. The DoS attacks come in various forms, differentiating in volumetric attacks, protocol attacks and application-layer attacks. The first ones flood the network with excessive traffic, the protocol ones exploit the vulnerabilities in network protocols. Finally, the application-layer attacks target the specific applications, with a slower traffic, making them harder to detect. Moreover, traditional volumetric attacks, are now often combined with more advanced methods such as application-layer attacks and multi-vector attacks, making their detection and mitigation even more difficult.

One common method to mitigate the DoS attack is rate limiting, that aims to control the number of request a user can make to a server within a specified timeframe. However, if from one side this solution reduce the potential impact of a volumetric DoS attack, it also can affect legitimate user's traffic. Another method is the traffic filtering, that consist in blocking malicious request based on predefined rules, being effective with basic attacks but not with new and more complex ones. Finally, there are Firewalls and Intrusion Detection Systems, which are designed to block unauthorised access and detect suspicious activities, looking for signature of specific DoS attacks. 

IT forensics can play a pivotal role in the detection and mitigation of DDoS attacks.
By analysing network traffic patterns, it is possible to identify anomalies that indicate a potential DDoS attack. Artificial Intelligence (AI) has revolutionized digital forensics, particularly in the context of DDoS attack detection. AI-driven tools can process vast amounts of data at unprecedented speeds, identifying patterns and anomalies that would be impossible for human analysts to detect manually. Through Machine Learning and Deep Learning algorithm, it is possible to produce prediction models starting from large datasets. By analysing the network traffic data, it is possible to perform a behavioural analysis, making possible the distinction of a normal and benign traffic from a malicious one, that may indicate a DoS attack. These models can process and analyse data in real-rime, providing automatic and immediate detection and response, without relying on human manual labour.

The importance of understanding DDoS attacks and their detection require the development of virtual environments for academic purposes. These environments allow students and researchers to simulate DDoS attacks in a controlled setting, providing hands-on experience in detecting and mitigating such attacks. Virtual labs also facilitate the testing of new defence mechanisms and the training of IT professionals, ensuring they are well-equipped to handle real-world cyber threats. 

This project aims to the realisation of a digital forensic AI model to recognise a DoS attack and its testing on a virtual network. The network is provided with a logging system, managed by an administration node, that collects the logs of all the nodes of the net. In a special way, the logging system is oriented to the collection of the data necessary to detect a DoS attack. The data are collected in a coherent way in relation to the dataset used to train the model. The model is trained on a dataset produced by a previous similar project by the professor Bordel and his team. The algorithm chosen to train the model is the MultiLayer Perceptron, which is a type of artificial neural network, consisted of multiple layer of neurons. The algorithm is capable of being trained on the basis of structured data, like the one of the dataset, and extract non-linear features thanks to the non-linear activation functions. The data used to predict or recognise an attack are mined by the metrics of the TCP connection and their performances. The collection of the data happens by means of eBPF, a technology that allows a user to interact directly with the kernel space. By doing so, it is possible to gain important and privileged information, which are usually inaccessible from the user space.


The secondary aim is to provide a safe and isolated environment in which it is possible to replicate the experiment. In this way, it is possible to perform a DoS attack without harming anyone or risk any legal consequence, offering, to students or researcher, the condition to conduct studies with the technologies involved and improve the security configuration of the system. The choice of the virtual setting, with the aid of containerization, makes the environment cheap, portable and fast to be built.

The thesis is organised as it follow:
\begin{enumerate}
    \item The chapter 2 is a brief exploration about related works and other solutions.
    \item The chapter 3 is a study about the DoS attack, going from the definition, to the typologies of attack. Then it proceeds on how to recognize, detect and mitigate them. Finally, there is a further in-depth analysis of four specific types of attack: SYN flood, HTTP flood, Slowhttp and ICMP flood.
    \item The chapter 4 describes how the virtual network has been built, the technologies involved and its structure.
    \item The chapter 5 deals with the AI model. It, indeed, describes the entire process of development, going from the choice of the dataset, the type of algorithm employed for the model and the baseline and finally the comparison of the results.
    \item The chapter 6 is about the collection of the data related to the traffic and connection, to feed to the prediction model.
    \item The chapter 7 is related to the attacker node and the tools used to perform the attacks.
    \item The chapter 8 is an analysis of the results collected by the log manager and the predictions made by the AI model.
    \item The chapter 8 concludes the thesis with a brief report of the entire project and future possible improvements.
\end{enumerate}



