Network Intrusion Forensics Tool

A web-based PCAP forensic analysis tool for detecting suspicious network activity, intrusion indicators, and attack patterns from packet capture files.

This tool performs automated forensic analysis of network traffic to identify:

• DNS anomalies
• Malicious infrastructure communication
• Beaconing behaviour
• Lateral movement indicators
• Threat intelligence matches
• Intrusion kill chain stages

The project is designed for cybersecurity learning, digital forensics, incident response, and threat hunting use cases.

---

Features

Traffic Analysis

• PCAP / PCAPNG / CAP file analysis
• Packet metadata extraction
• Network behaviour profiling

DNS Analysis

• Suspicious domain detection
• DGA-like subdomain entropy analysis
• Beaconing / periodic DNS timing anomaly detection
• Victim identifier decoding from encoded DNS patterns

Threat Detection

• Known malicious IP cross-referencing
• Threat intelligence matching
• HTTP masquerading detection
• Command-and-control (C2) communication identification

Lateral Movement Detection

• SMB activity detection
• RDP connection analysis
• WMI behaviour indicators
• Port scanning detection

Forensics Reporting

• Chronological attack timeline
• Kill chain stage mapping
• Risk score generation
• Verdict classification:
  • Clean
  • Suspicious
  • Likely Compromised

---

Detection Capabilities

The tool incorporates detection logic inspired by real-world attack patterns including:

• SolarWinds / SUNBURST
• DNS beaconing malware
• C2 infrastructure communication
• Internal lateral movement behaviour

Threat intelligence sources include public IoCs and advisories from:

• Microsoft Security Response Center
• FireEye / Mandiant
• CISA
• CrowdStrike

---

Tech Stack

• Python
• Flask
• Scapy / Packet Analysis Libraries
• HTML / CSS / JavaScript

---

Project Structure

network-intrusion-forensics-tool/
│
├── app.py
├── requirements.txt
├── README.md
│
├── modules/
│   ├── analyser.py
│   ├── dns_analyser.py
│   ├── network_analyser.py
│   └── threat_intel.py
│
└── templates/
    └── index.html

---

Setup

Clone Repository

git clone https://github.com/your-username/network-intrusion-forensics-tool.git
cd network-intrusion-forensics-tool

Install Dependencies

pip install -r requirements.txt

Run Application

python app.py

Open in browser:

http://localhost:5000

---

Usage

1. Launch application
2. Upload a .pcap, .pcapng, or .cap file
3. Start analysis
4. Review generated forensic report

The report includes:

• Suspicious indicators
• Threat matches
• Timeline
• Kill chain mapping
• Final risk verdict

---

Sample PCAP Sources

You can test the tool using publicly available packet captures from:

• Malware Traffic Analysis
• Wireshark Sample Captures
• NETRESEC Public PCAP Repository

Recommended:

• SUNBURST-related DNS traffic
• Malware beaconing traffic
• Lateral movement traffic samples

---

Academic Context

Built as a Digital Forensics and Cybersecurity project to demonstrate practical network forensic analysis techniques used in incident response and threat hunting.

---

Future Improvements

• ML-based anomaly detection
• MITRE ATT&CK mapping
• SIEM integration
• PDF forensic report export
• Live packet capture support