## 7 Methodology Applied in This Research
### Evaluation of SNORT (Open Access)
#### 7.3.2 Analysis and Findings  
In the observation, a third-party network scanning application tool called IP scanner was used to identify the IoT devices on the home network as shown in Figure 13 below.  
Figure 13 above shows a breakdown of the IoT devices connected and their manufacturer plus the MAC address of the device. Additionally used was Wireshark, also an OpenSource Software released under the GNU General Public License. The GNU is a widely used free software license that allows users the freedom to run, study, share, and modify the software.  
Figure 14 below shows an extract of the sample data analysed from the SNORT log files using Wireshark, a more advanced tool for IP scanners.  
The results merely show the types of regular traffic that could be seen if connected to the internet in general from home whilst working, playing games, and watching YouTube. Figure 15 below shows the protocols that were captured during this time period, and this shows the variations and counts of these protocols over this period of SNORT capturing this information.  
Figure 12: Location of SNORT folders extracted from SNORT website [44].  
Figure 14: SNORT log file in Wireshark.  
Figure 15: Protocol versus the Count Number of Times Protocol was Detected by SNORT.  
Figure 15 above shows evidence of Transmission Control Protocol (TCP) which is IP traffic which is the normal behaviour for when we connect to the internet and the number of times it was detected noting the count of the protocol. It was good to see that the results captured TLSv1.2 which is the Transport Layer Security as this is vital in securing the network traffic and how users browse the internet. Amongst other protocols that were captured, the HTTP/XML was also an important protocol to identify, as this shows the detection of any XML coding that could potentially arrive at the user's session and could potentially cause threats to the system. XML documents are very frequently used in the transmission of viruses through the internet. This shows that SNORT was able to identify when users are accessing normal pages or xml coding database backend pages.  
The findings show that it was easy enough to install and run SNORT. The rules were easy enough to change once the process was clear on how to do this from various sources on the internet. The training available to SNORT is by self-teaching however did require someone who was highly trained to perform more complex network detection. SNORT was free to download and use, and its costs were minimal. The adaptation and use of other software to complement SNORT to analyse the data and the findings took some comprehension from experts in the field. Wireshark was used to assist in the completeness of this observation. It was clear that whilst this observation was running, there were no threats to the home network and that users were operating in a secure and safe environment connected to their office network. The ideal scenario moving forward would be to see how this behaviour changes in an office and commercial setting with more devices connected compared to the home network, and more exposure to the internet worldwide in a direct link within the office environment. The home scenario was subjected to a family-run network with certain rules applied on the Virgin Media router that had links to the office network via VPN connections. Due to the COVID-19 lockdown, the observation and experiment also involved and exposed other IoTs within the household generating traffic in sudden spikes in threats happening due to the shift in working from home. Certain rules were changed on the Virgin Media router to reflect the safety of browsing, how browsing was done and the times in which browsing was allowed.