# Detection of Hacker Intention Using Deep Packet Inspection
## 2 Related Work  
Related work can be split into two categories, namely foundational protocol operation and research related to the detection of network reconnaissance activity, such as network discovery and port scanning. We reviewed [8] to confirm our understanding of the TCP protocol and related TCP control flags. We confirmed that the TCP flag states provide connection-oriented information that can be used to detect network discovery and port scanning. TCP has control flags in the TCP packet header. We conducted a literature search on scanning tools to determine variations in their functionality. We concluded that Nmap, an open-source tool, provided all the capabilities to do network discovery and generate port scanning traffic. The authors of [9] undertake a discussion on the Nmap principles, rules, and experiments. We reference the official Nmap website [5] for confirmation of Nmap usage and commands.  
In regard to the detection of abnormal traffic, ref. [10] used unsupervised deep learning techniques for identification of IoT botnet activities. The authors of [11] used selected features in analyzing normality and abnormality with Wireshark for detection of anomalies. Their approach, however, required constant attention: profiling must occur frequently because traffic behavior patterns change and, therefore, baselines become outdated. The authors of [12] analyzed control flags to detect congestion in a network by observing the ratios of TCP flag counts. The authors of [13] presented a method to determine abnormal traffic by using flow characteristics and the use of a connection threshold. With much interest, we reviewed [14]. The authors examined TCP packets, formulated behavior for TCP control packets, and taught the behavior to a neural network for detection. Their work led us to examine the use of AI/ML algorithms, applying our knowledge of TCP control flag states to label a dataset for ground truth. To our knowledge, this is the first research to show how automated labeling logic can be applied based on certain conditions in the deep packet features.3. TCP Flags Overview  
TCP flags are used to indicate a particular state during a TCP conversation. They can also be used for troubleshooting purposes or to control how a particular connection is handled [15]. TCP flags are various types of flag bits present in the TCP header. Each of them has its own significance. They initiate connections, carry data, and tear down connections. The commonly used TCP flags are SYN, ACK, RST, FIN, URG, and PSH. Others not so common include CWR and ECE [15]:  
* SYN (synchronize): packets that are used to begin a connection.  
* ACK (acknowledgment): packets that are used to confirm receipt of data packets; also used for confirmation of initiation request and tear down requests.
* RST (reset): indicates that the connection is down or perhaps that the service is not accepting the requests.
* FIN (finish): signifies that the connection is being torn down. Both the sender and receiver send FIN packets for graceful termination of the connection.
* PSH (push): signifies that the incoming data should be passed to the application directly instead of being buffered.
* URG (urgent): signifies that the data carried by the packet should be processed immediately by the TCP stack.
* CWR (congestion window reduced) indicates the TCP segment has been received with the ECE flag set.
* ECE: signifies that TCP peer is Explicit Congestion Notification (ECN)-capable.  
The flag bits in most normal TCP data packets are SYN, ACK, FIN, or some combination of these three. Other combinations of the TCP flags are likely abnormal operations, whether intentional or not intentional. The detection of these abnormal operations will lead to the early detection of malfunctioning hardware or the exposure of hacker information gathering and scanning activities. Therefore, it is useful to have an ML system that can detect this abnormal behavior.