Forensics Investigation On CyberAttack Scenario.pptx

Forensics Investigation On CyberAttack Scenario.pptx

1. Forensics Investigation On CyberAttack Scenario Here is where your presentation begins

2. C ontents False Data Injection 2. 1. Distributed Denial of Service Conclusion 3.

3. 01 Distributed Denial of Service

4. DDoS is an attack that attacks the network resource to prevent legitimate users from accessing the affected system. Attackers may use two methods to launch DDoSsending malformed packets to confuse or disrupt legitimate users by exhausting the resources. Definition of DDoS Overview

5. Investigators need to prepare network forensic tools such as network sniffers to investigate DDoS attacks. Network Forensic Tools Begin with acquiring data from a network connection.
Collect data received in MDMS to detect the attack.
The artifacts collected from the dataset include log files, data files, data caches, transaction logs, and windows log events. Data Collection Analyze collected data to produce significant evidence using appropriate tools.
Techniques vary based on the type of collected data.
Compare readings during DDoS attacks with readings during normal traffic flow. Data Analysis Construct the attack scenario to obtain a correlation of the evidence with the crime event.
Design a graph to show the attack on smart grid components based on the analysis. Attack Scenario Construction Document all activities in legal forms to maintain the chain of custody.
Present the result and documents before the court to classify the case.
Include equipment and tools used in the investigation.
Store and disseminate the case for other relevant investigations. Documentation and Presentation Forensic Investigation of DDoS

6. 02 False Data Injection

7. FDI attack affects packets' data integrity by modifying their payloads. FDI attacks could bypass the SCADA system. Definition of FDI Overview

8. Data Collection and Analysis Detection Challenges Testbed Setup Develop a testbed consisting of four main hardware components to simulate an FDI attack. Gather data from the packet sniffer and ARP cache of data collectors and smart meters.
Use SQL database to view and display artifacts of user data, device name, last accessed, last login, created by, etc.
Compare attributes between normal traffic and under attack traffic to detect the FDI attack. FDI attacks can be subtler than DoS attacks, making them difficult to detect.
Forensic investigators must prepare a subtle approach to detect the attack. Forensic Investigation of FDI

9. 03 Conclusion

10. Thanks Edited by Education G2Academy