# Detection of Hacker Intention Using Deep Packet Inspection
## 3 Methodology
A Random Forest algorithm was used for feature selection, reducing features for input to the model from 87 to 22 features. The three models were created, and the test dataset was applied to each algorithm. The programs were created and executed on an Intel Core7 running Windows 11. Google CoLab, an interactive development environment, was used to develop the models. An excerpt from the CoLab notebook is shown in Figure 4. We executed the code on a Tensor Processing Unit (TPU) processor. We developed ML programs in Python that labeled each sample as indicated: normal (0) or abnormal (1). Since we are demonstrating ML supervised algorithms, it was essential to label the dataset with the correct label value by developing filtering logic, which is a novel approach, to the best of our knowledge. The filtering logic was based on the state of TCP Flags and the application name. The pcap file is input to NFStream, a data analysis framework [3]. NFStream reads the pcap file and converts it into a Pandas data frame. The authors in [3] provide a definition of each feature. Because of the deep packet inspection, we obtained features, including TCP flag states and flow statistics, such as the number of bidirectional packets in a link session. In Figure 4, we show one set of logic using the features (data items) provided, which was utilized to carry out the labeling for binary classification. The labeling of the dataset is critical in developing a ML model. \begin{table}
\begin{tabular}{l l l} \hline
**Probe Type** & **Nmap Command Issued** & **Short Description** \\ \hline Nmap host scan & sudo nmap 172.16.1.20 & Default method of scanning the host for identifying open ports. \\ \hline Nmap ping scan & sudo nmap -sn 172.16.1.20 & Does Nmap host discovery to determine available hosts without port scan. \\ \hline TCP SYN scan & sudo nmap -sS 172.16.1.20 & TCP packet sent with SYN flag set; after receiving response in the form of SYN-ACK, it disconnects by sending RST flag. Also known as stealth scan. \\ \hline TCP connect scan & sudo nmap -sT 172.16.1.20 & Attempts TCP connection during the scan by issuing a TCP connect call. \\  & Default TCP scan when SYN scan is not an option. \\ \hline TCP ACK scan & sudo nmap -sA 172.16.1.20 & Determines whether the port is filtered or unfiltered \\ \hline TCP window scan & sudo nmap -sW 172.16.1.20 & Similar to ACK scan except it exploits implementation details of certain systems to differentiate open ports from closed ports. It also can determine if port is filtered. \\ \hline UDP scan & sudo nmap -sU 172.16.1.20 & Used with UDP protocol to determine open, closed, filtered state of UDP ports \\ \hline Null scan & sudo nmap -sN 172.16.1.20 & Scan with TCP header zero to determine state of port (open, closed, filtered). \\ \hline FIN scan & sudo nmap -sF 172.16.1.20 & Scan with FIN flag set to determine state of port (open, closed, filtered). \\ \hline XMAS scan & sudo nmap -sX 172.16.1.20 & Send packet with FIN, URG and PUSH flags set to determine state of port (open, closed, filtered). \\ \hline \end{tabular}
\end{table} 
Table 2: Nmap commands used [5]. Correctly labeling a dataset requires input from a domain expert. To our knowledge, researchers in this area do little to explain how they labeled a dataset for the ground truth. We labeled the dataset for the binary classification of normal and abnormal (TCP Syn Scan) traffic. In the logic of Figure 4, we set label = 1 (abnormal), if the application is unknown and the RST flag count is greater than or equal to a value of 1 for source or destination. We confirmed this logic based on the operational principle that either the source or the destination address will set the RST flag. Nmap starts by sending a SYN, as shown in Figure 5. In a normal connection, the target would respond with a SYN/ACK and the source (Nmap host) would respond with data packets until complete. A hacker using an Nmap SYN scan would respond with an RST because it has the information it needs.