## 7 Methodology Applied in This Research
### Evaluation of the Hybrid IDS-Cisco Fiepower in a Live Office Network
#### 7.2.2 Analysis and Findings  
The Firepower evaluation was done on the Cisco Intrusion Detection and Prevention Device: Cisco ASA5516X Firepower inclusive of the IPS, AMP and URL Licenses. This device is manufactured by Cisco and is a hybrid model that uses the hybrid model of statistical analysis combined with features of the machine learning algorithm of behavioural analysis. The Cisco IPS network-based intrusion prevention system (NIPS) uses signatures to detect network-based attacks [55; 56]. Data from the Firepower were extracted and were analysed for the month of March, April, and May 2020. The results captured showed traffic and intrusion events over time from 20 April to 18 May 2020. Within the results, it was noticeable that spikes were observed through mid to end of April when the UK was preparing to go into lockdown. These spikes were intrusion events occurring around those dates. The Firepower was able to detect these events and log an audit trail and give an output in the form of a graph and alert. The Firepower was also able to share details of the Classifications and Priority of these Intrusion Event Details during this period of each event. It showed the type of events against classification, priority, and the number of times these events took place. Classifications such as \"Web Application Attack\", \"A Network Trojan was Detected\", \"Attempted Information Leak\" and \"Attempted User Privilege Gain\" were amongst those that were identified by the Firepower. Priorities such as \"high\" and \"medium\" were given against these classifications and the number of times these events occurred were counted. Classifications such as \"Web Application Attack\" occurred 171 times via an SQL injection attempt. The Firepower gave this a high priority and regarded this as high importance. Events identified ranged from SQL injection, malware detection and console attempts. Through a selection of workflows and drilldown events, the Firepower was able to also detect source countries such as China making multiple intrusions and their source IPs. The Firepower was also able to identify the Destination IP and the country being the UK. The Firepower was able to show detection from country China and its malicious actors trying to penetrate the network and the device IDS dropping this intrusion. The Firepower was able to show detection on when the device had dropped this connection from China as it recognised it to be a harmful attempt into the network and stopped it before any malice was attempted. In particular, categories of files used to try to penetrate the network from Firepower were the likes of multimedia, pdf files, office documents and executables. The Firepower was also able to show the intrusion by Geolocation and by where the hacking originated from as seen from Figure 6 below. From the pie charts above, a list of all the countries trying their hacking techniques can be seen in the case of the UK. Figure 6: Geolocation Information extracted from Firepower. The Firepower was also able to extract information such as the Top File Types Received via the network from Figure 7 below. It can be seen from the chart in Figure 7 above, that files with extensions of.SWF, ZIP and.PDF were the files that were infected and caused harm and were detected and securely quarantined and scanned before being released. The Firepower also had the reports to extract Top File Names that tried to penetrate the network during these months as shown in Figure 8 below. As mentioned previously, Impact was an important ML classification in terms of the detection period and the preventative measure that took place during these months. The following chart in Figure 9 below showed high Impact as zero (0), and medium Impact indicated as a one (1). Figure 8: Top File Names extracted from Firepower. Figure 7: Top File Types extracted from Firepower. These impacts shown in Figure 9 indicate the value of the potential severity of an attack.