# Detection of Hacker Intention Using Deep Packet Inspection
## 3 Methodology  
Intention detection seeks to pinpoint abnormal information gathering activity directed to a target network or system with the objective of classifying the goals or intentions of the intruder. TCP flags- CWR, ECE, URG, ACK, FSH, RST, SYN, and FIN- provide state information about the target based on a flag being set by the sender or receiver. Table 1 shows different port scanning techniques that may be used for information gathering about a target host or system. We included a UDP protocol scan in the research, which uses no flags, but there are other indications that can be observed. First, in order to ensure and confirm our understanding, we reviewed TCP flag uses [15, 16]. The setting of the flags and flag counts indicate that certain actions are being conducted, such as operating-system and port scans. Secondly, we observed the traffic in our sandbox LAN which consisted of the system shown in Figure 1.  
Network Mapper (Nmap) is a tool used for network exploration and security audits in assessing a system's vulnerabilities. Nmap determines what hosts are available in the network, what services are available per host (application name and version), what operating system is used per host, and whether a firewall/filter(s) is used. We issued Nmap commands toward a target Windows 2012 Server from the Kali 0100 attack device, captured the traffic to a pcap file via the Kali 0200 packet collector, and viewed the pcap file in Wireshark. By observing Nmap command traffic in a small network, we were able to determine the behavior of network traffic and observe the settings of TCP flags. This allowed us to develop Python logic for labeling samples with the abnormal label (label = 1), otherwise label = 0. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Port Scan** & **Protocol** & **TCP Flag** & **Target Reply** & **Target Reply** \\
**Technique** & & & **(Open Port)** & **(Closed Port)** \\ \hline TCP Connect & TCP & SYN & ACK & RST \\ SYN Scan & TCP & SYN & ACK & RST \\ SYN/ACK Scan & TCP & SYN/ACK & RST & RST \\ FIN Scan & TCP & FIN & No & RST \\ ACK Scan & TCP & ACK & No & RST \\ NULL Scan & TCP & No & No & RST \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Scan types and TCP flag conditions [16]. We generated a dataset in our SECURE Lab that captured benign and scan/probe traffic using Nmap. The general network setup is shown in Figure 2.  
We issued Nmap commands for scanning on the 10.0.0.x network with the target node on network 172.x.x.x. This network represents the typical business network. Network address translation is implemented such that the internal network address is not exposed to the internet. Nmap tools were used to scan the network with the combination of the different Nmap flags to perform the probing. The Nmap tool was used to scan the network (172.16.1.x/24) for scan and stealth scan probing. Wireshark, an open-source network monitor, was used to capture the probing traffic using port mirroring techniques on a Cisco network switch. The following table (Table 2) shows the commands entered that correspond to the traffic generated on the network and captured to a pcap file. From the Kali Linux 1  
Figure 1: Inspection lab setup with devices and addresses. Figure 2: SECURE lab setup [17]. (an Offensive Kali) workstation, the following Nmap commands were entered, while simultaneously generating normal network traffic with the Spirent CyberFlood CF20. Table 2 shows the commands entered in order of execution. We chose to implement three models in Python- Naive Bayes, Random Forest, and Logistics Regression due to prior experience and the high accuracy (>90%) of these algorithms in our prior experimental results. Figure 3 summarizes the methodology and approach to model development. Data preprocessing on the dataset included removal of samples with missing data, balancing the dataset, performing feature selection, normalizing the data features, splitting the dataset into training/testing sets, and training the data using the three ML algorithms.