# Detection of Hacker Intention Using Deep Packet Inspection
## 6 Conclusions  
The types of scans in Table 1, adopted from [16], are undertaken when a hacker is in the information-gathering and scanning phases. This activity can be detected using the ML model for binary classification. We suggest the following concept--that using the TCP flag states, presented through NFStream deep packet inspection, we can build ML models to detect specific hacker behaviors from which intent can be inferred at an early stage by characterizing the behavior associated with certain types of tools and scans. This was performed for the Nmap SYN scan in this study but can be extended to others.  
Figure 8: Naive Bayes Confusion Matrix.  
Through the experiment, we demonstrated the selection of important features using the Random Forest feature selection. Also, the additional deep packet features of NFStream allow for the preservation of the TCP states of each link session.  
In the future, we plan to build a multi-classifier model for detecting the different scans in Table 1 and other specific types of Nmap scans in the early identification of hacker reconnaissance activity, from which hacker intent may be inferred. Also, we plan to study other techniques to detect horizontal scanning and vertical scanning for botnet detection.  
We believe that intent detection should be part of any intrusion detection system and that this study is a steppingstone to establishing intruder intent. Knowing the intention of an intruder could be used along with the existing field of cyber deception to develop a strategy to thwart an attack and safeguard resources. Furthermore, we believe the future of network IDS will be based on identification of intention of the attacker along with the type of attack. The lightweight system developed in this research can be deployed to a microcontroller unit like the NVIDIA Jetson Nano.  
[PERSON]. (principal investigator): concept originator and concept development; [PERSON]: concept development and software and lab implementation; C.A.K.: DoD Mentor of research, assisted in defining research scope; A.H.A.H.: assisted in mentoring of research and scope development; J.C.A.: provided important insight into methodology; B.C.D.: helped with laboratory setup and concept implementation. All authors have read and agreed to the published version of the manuscript.  
Department of Defense, Prairie View A&M University College of Engineering.  
Data are available upon request, pending approval of the SECURE research center director.  
Research was sponsored by the Under Secretary of Defense for Research and Engineering (USRE) and was accomplished under Cooperative Agreement Number W911 NF-19-2-0120. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the USRE or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation herein. Additionally, this research was supported in part by the Prairie View A&M University Roy G. Perry College of Engineering and facilitated in the SECURE (Systems to Enhance Cybersecurity for Universal Research Environment) Center of Excellence in the Prairie View A&M University Roy G. Perry College of Engineering.  
The authors declare no conflict of interest.