Operations-in-Cyber-Defense-I - This academic project explores defensive cybersecu

项目说明

Operations in Cyber Defence - I

Academic Project Report - M.Sc. IT IMS & CS (Integrated)
Gujarat Uni | Batch 2022-2023

A comprehensi on Security Operations Center (SOC) implementation, Network Security Monitoring, and defensi operations with practical incident response demonstrations.

---

📋 Project O

Objective

This project demonstrates defensi operations from a Security Operations Center perspecti on threat detection, in, and incident response using enterprise-grade NSM tools and frameworks.

Key Highlights

* ✅ SOC Implementation: Four-tier operational model (Triage → In → Threat Hunting → Management).
* ✅ Network Security Monitoring: Full deployment of Security Onion with IDS/IPS, SIEM, and packet analysis.
* ✅ Threat Intelligence: Integration of MISP, CVE/CWE databases, YARA rules, and threat feeds.
* ✅ Real Incident Analysis: Complete in of Remcos RAT malware infection.
* ✅ Assessment: Open with CVSS v3.1 risk scoring.
* ✅ Industry Standards: NIST frameworks, MITRE ATT&CK, OWASP best practices.

Scope

Core Problem Addressed: Human error accounts for 95% of security breaches (IBM Study). This project demonstrates detection and response capabilities to mitigate threats that bypass traditional security controls.

Focus Areas:

* Security Operations Center workflows (Tier 1-4 operations)
* Network Security Monitoring and packet analysis
* SIEM deployment and log correlation
* Threat intelligence integration and IOC management
* assessment and risk management
* Real-world incident in and response

---

🎯 Learning Outcomes

This project demonstrates proficiency in:

Technical Skills

* Network Security Monitoring: Packet capture analysis, session tracking, traffic correlation.
* SIEM Operations: Log aggregation, query de, alert correlation, dashboard creation.
* Incident Response: Alert triage, in workflows, IOC extraction, timeline reconstruction.
* Threat Intelligence: MISP platform, threat feeds, IOC sharing, reputation checking.
* Management: Open, C, risk assessment.
* Malware Analysis: File hashing, beha analysis, C2 detection.
* IDS/IPS: Snort/Suricata rule de, signature tuning, false positi.

Security Domains

* Defensi operations and SOC workflows
* Network traffic analysis and anomaly detection
* Threat hunting and proacti
* Security information and event management (SIEM)
* assessment and risk management
* Incident response and forensic in

Professional Competencies

* Security tool deployment and configuration
* Technical documentation and incident reporting
* Risk assessment and impact analysis
* Compliance frameworks (NIST, OWASP, MITRE ATT&CK)
* Threat intelligence research and analysis

---

📚 Project Structure

Section 1: Introduction to Cybersecurity (Pages 1-18)

* Offensive Security
* InfoSec Color Wheel and team structure
* CIA Triad framework
* Core Security Problem: Human error analysis (skill-based )

Section 2: , Risks and Threat Management (Pages 19-50)

* Management: Lifecycle, CVSS v3.1 scoring, CVE/CWE databases
* Risk Management: NIST SP 800-30 framework, risk assessment procedures
* Threat Management: IOCs, IOAs, threat intelligence lifecycle
* Tools Implemented: OpenVAS, YARA, LOKI, MISP

Section 3: Security Operations and Monitoring (Pages 51-104)

* SOC Model: Four-tier operations (T1: Triage, T2: In, T3: Hunting, T4: Management)
* Data Types: Full packet capture, session data, transaction logs, alert data, statistical analysis
* Alert Sources: Snort, Suricata, Zeek, OSSEC
* SIEM Platform: ELK Stack (Elasticsearch, Logstash, Kibana)
* Tools & Workflows: Sguil, Wireshark, NetFlow, Cisco Talos Intelligence

Section 4: Case Study - Windows Host Attack (Pages 105-123)

* Real-world in of Remcos RAT infection (March 19, 2019)
* Multi-tool correlation analysis
* IOC extraction and documentation
* Remediation recommendations

---

🛠️ Tools & Technologies

Security Monitoring Platform

| Tool | Category | Purpose |
| --- | --- | --- |
| Security Onion | NSM Platform | Integrated security monitoring suite |
| Snort 2.9 | NIDS | Signature-based intrusion detection |
| Suricata | NIDS | Multi-threaded IDS with GPU support |
| Zeek (Bro) | NSM | Beha analysis and protocol parsing |
| OSSEC/Wazuh | HIDS | Host-based intrusion detection |

SIEM & Analysis

| Tool | Category | Purpose |
| --- | --- | --- |
| Elasticsearch | Search Engine | Log indexing and search |
| Logstash | Data Pipeline | Log collection and normalization |
| Kibana | | Dashboards and data exploration |
| Sguil | Alert Console | IDS alert management and correlation |
| Wireshark | Packet Analysis | Deep packet inspection |

Threat Intelligence

| Tool | Category | Purpose |
| --- | --- | --- |
| MISP | TIP | Threat information sharing platform |
| Cisco Talos | Threat Feed | File reputation and IOC |
| | File Analysis | Malware scanning and reputation |
| YARA | Pattern Matching | Malware signature detection |
| LOKI | IOC Scanner | Host-based IOC detection |

Assessment

| Tool | Category | Purpose |
| --- | --- | --- |
| OpenVAS | Scanner | Network discovery |
| GVM | Management | Greenbone Manager |
| C | Risk Scoring | se rating |

Testing Platforms

* Workstation 16 Pro: for isolated lab
* TryHackMe: Hands-on cybersecurity training rooms
* Kali Linux 2021: Penetration testing distribution

---

🔬 Lab Setup

Architecture

Base Requirements

Hardware/:

Software Stack:

Network Configuration

---

✨ Features Implemented

1. Security Operations Center (SOC) Model

Four-Tier Operation Structure:

2. Network Security Monitoring (NSM)

Data Collection Types:

| Type | Description | Retention |
|------|-------------|-----------|
| Full Packet Capture | Complete network con | 7 days |
| Session Data | Connection metadata (5-tuple) | 30 days |
| Transaction Logs | HTTP, DNS, SSL, SMB protocols | 90 days |
| Alert Data | IDS/IPS signature matches | 1 year |
| Statistical Data | Beha analytics | Real-time |

Alert Sources:
* Snort: 50,000+ community rules (GPL, ET, VRT)
* Zeek: Beha detection and protocol analysis
* Suricata: Multi-threaded signature matching
* OSSEC: Host-based file integrity and log monitoring

3. SIEM Platform (ELK Stack)

Elasticsearch:
* Log indexing and search engine
* RESTful API for queries
* Distributed NoSQL architecture

Logstash:
* Data ingestion and normalization
* Multi-source log collection
* Field parsing and enrichment

Kibana:
* Real-time dashboards
* Custom
* Sa and filters

Sguil:
* Alert correlation console
* Event categorization
* Pivot to packet captures

4. Intrusion Detection Systems

Snort Rule Example:

Detection Capabilities:
* Signature-based detection (Snort, Suricata)
* Beha analysis (Zeek)
* Protocol anomalies
* File extraction and analysis
* C2 communication detection

5. Threat Intelligence Integration

MISP Platform:
* Event tracking and IOC management
* Taxonomies: MITRE ATT&CK, TLP, PAP
* API integration with SIEM
* Automated IOC sharing

Threat Feeds:
* Cisco Talos Intelligence
* Emerging Threats ruleset
* CVE/CWE databases
* file reputation
* AbuseIPDB IP reputation

6. Management

Open:
* Network service discovery
* detection and C
* Authenticated scans
* Compliance auditing

CVSS v3.1 Scoring:

7. YARA Rule De

Custom Malware Detection:

Integration:
* LOKI IOC scanner for host scanning
* rule feed for latest signatures
* Custom rules for organization-specific threats

---

🔄 Process Flow

Incident In Workflow

Data Pipeline

---

📊 Practical Demonstrations

Case Study: Remcos RAT In

Incident Timeline - March 19, 2019

In Tools:

| Tool | Purpose | Findings |
|------|---------|----------|
| Sguil | Alert correlation | 12 related alerts, CNT=8 |
| Wireshark | Packet analysis | Extracted test1.exe and F4.exe |
| Kibana | Log | HTTP requests, DNS queries |
| Cisco Talos | File reputation | Confirmed malware hashes |
| Zeek | Transaction logs | File details, HTTP metadata |

IOCs Extracted:

Remediation Actions:

1. ✅ Isolated infected host (10.0.90.215) from network
2. ✅ Blocked C2 IPs at firewall
3. ✅ Deployed Snort rule for Remcos detection
4. ✅ Updated malware signatures in AV
5. ✅ Shared IOCs via MISP
6. ✅ Conducted full network sweep for lateral mo

---

🎓 Key Methodologies

NIST Cybersecurity Framework

This project follows the NIST CSF fi structure:

MITRE ATT&CK Mapping

Techniques Observed in Case Study:

| Tactic | Technique | ID |
|--------|-----------|-----|
| Initial Access | Drive-by Compromise | T1189 |
| Execution | User Execution | T1204 |
| Persistence | Registry Run Keys | T1547 |
| Defense E | Obfuscated Files | T1027 |
| Credential Access | Input Capture (Keylogging) | T1056 |
| Discovery | System Information Discovery | T1082 |
| Lateral Mo | Exploitation of Remote Services | T1210 |
| Collection | Automated Collection | T1119 |
| Command and Control | Standard Non-Application Port | T1571 |
| Exfiltration | Exfiltration Over C2 Channel | T1041 |

Ethical Hacking Principles

* Authorized Testing: All demonstrations in controlled lab (TryHackMe, Security Onion)
* No Harm: Purpose-built en only
* Responsible Disclosure: Focus on defense and remediation
* Educational Purpose: Academic research and learning

---

📖 References

Official Documentation

* NIST Special Publication 800-30 (Risk Assessment)
* NIST Special Publication 800-150 (Threat Information Sharing)
* CVSS v3.1 Specification
* MITRE ATT&CK Framework
* OWASP Top 10

Tool Documentation

* Security Onion:
* Elasticsearch:
* Snort:
* Zeek:
* MISP:
* OpenVAS:

Threat Intelligence

* Cisco Talos Intelligence:
* :
* C:
* CWE Database:
* Exploit Database:

Training Platforms

* TryHackMe:
* Cisco NetAcad:

Books & Publications

* Cisco Cyber Operations Documentation
* Red Team Journals
* Ethical Hacking and Countermeasures v11
* NIST Cybersecurity Publications

---

📝 De Notes

Project Context

This is an academic research project completed for the M.Sc. IT IMS & CS program at Gujarat Uni. The study demonstrates defensi operations through controlled lab en.

Academic Details:
* Institution: Gujarat Uni
* Program: M.Sc. IT IMS & CS (Integrated) - Semester 7
* Mentor: Prof. Nirali Chavda
* Submission: December 31, 2022

Ethical & Legal Considerations

✅ Authorized Testing: All demonstrations conducted in isolated lab en
✅ No Unauthorized Access: Testing performed on TryHackMe rooms and personal VMs
✅ Educational Purpose: Focus on defensi and incident response
✅ Responsible Research: No exploitation of production systems

Limitations

* Lab en may not reflect enterprise-scale SOC operations
* Limited threat hunting dataset (based on publicly a samples)
* Tool reflect 2022 deployment (may ha)
* Case study uses documented malware from TryHackMe exercises

---

👤 De and Maintained By

Derick Dmello
M.Sc. IT IMS & CS (Integrated)
Gujarat Uni

Connect:
* GitHub: -io
* LinkedIn: dmelloderick

---

About

A comprehensi project demonstrating Security Operations Center implementation, Network Security Monitoring, and defensi operations with real-world incident response.

License

This academic project report is submitted for educational purposes as part of the M.Sc. IT IMS & CS program at Gujarat Uni.

Copyright © 2026 Derick Dmello. All rights reserved.

---

Keywords: Cybersecurity SOC Security-Operations Network-Security-Monitoring Incident-Response SIEM ELK-Stack Threat-Intelligence IDS-IPS Malware-Analysis Security-Onion Snort Zeek MISP YARA OpenVAS CVSS NIST MITRE-ATTACK

项目信息

开发语言：未知

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This academic project explores defensive cybersecurity operations through practical implementation of Security Operations Center (SOC) workflows and Network Security Monitoring (NSM)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。