Topic 3.5 Notes – Detecting Network Attacks

What Network Attack Detection Is

Detection means looking for evidence of attacks, not just trying to block them ahead of time. Even well-defended networks still generate activity, and that activity leaves traces.

You’ve already seen the main evidence sources across the unit:

• Log files are time-ordered event records. Common fields include timestamp, source and destination IP, ports, protocol, allow or deny action, and alert text.
• Packet captures store packet-level traffic so you can inspect IPs, ports, protocols, and patterns.
• Device state tables show what a device currently believes, like an ARP table on a gateway or a MAC address table on a switch.
• Wireless scans show SSIDs, BSSIDs, channels, and signal strength.

A log becomes useful when you can spot a pattern that stands out, like repeated failed SSH logins followed by a successful one from the same source IP.

Suspicious SSH login pattern in a network log

The big problem is scale. A medium-sized organization may produce millions of records per day, so humans need automated tools to filter and prioritize what matters.

Automated Detection Tools

Three tools show up over and over on quizzes and scenarios.

NIDS

A network intrusion detection system watches network data for malicious patterns and raises an alert.

• It detects and alerts
• An alert means suspicious, not automatically confirmed attack
• You still need context. A port scan alert could be an attacker, or it could be an approved admin scan

NIPS

A network intrusion prevention system does detection too, but it can also act.

Common actions include:

• closing ports
• blocking IP addresses
• blocking MAC addresses
• rejecting protocols

This is faster for containment, but a bad decision can block legitimate traffic.

SIEM

A security information and event management system collects logs and alerts from many places and correlates them.

• Sources include firewalls, NIDS/NIPS, routers, switches, servers, and applications
• Its value is seeing the pattern across systems, not just one event
• Analysts investigate SIEM alerts and then close, contain, resolve, or escalate

This network diagram helps you picture the placement difference. The NIPS sits inline where it can stop traffic, and the NIDS monitors traffic from the side and alerts on what it sees.

NIDS vs. NIPS placement in a network

Lock in this distinction:

• NIDS = detects and alerts
• NIPS = detects, alerts, and can stop traffic
• SIEM = centralizes and correlates many data sources

Detection Methods and When to Use Them

There are three detection methods.

A few details matter a lot:

• Signature-based is faster and more efficient. It needs signature updates.
• Anomaly-based depends on a clean baseline. If the baseline was built on compromised systems, the “normal” model is poisoned.
• Hybrid is chosen when missing an attack would be especially costly.

A simple selection routine:

1. High traffic volume points toward signature-based
2. Stable traffic patterns make anomaly-based useful
3. Critical systems often justify hybrid
4. Likely novel attacks plus limited budget points toward anomaly-based

Tradeoffs in Detection and AI Thresholds

You’ll compare methods using four impacts:

• Speed: signature is faster than anomaly, especially at scale
• Cost: anomaly needs more hardware; hybrid costs the most
• False positive: says attack when activity is legitimate
• False negative: misses a real attack

Students mix up the last two constantly. Keep them straight:

• False positive = wasted investigation time and alert fatigue
• False negative = attacker keeps operating

AI is used because the data volume is too large for people alone. It classifies activity as malicious or normal and often gives a probability score.

Memory anchor:

• same event scored 72% malicious
• threshold 65% → alert
• threshold 80% → no alert

Low threshold means more alerts and more false positives, but fewer missed attacks. High threshold means fewer alerts, but more false negatives.

Recognizing Attack Indicators in Logs and Traffic

Use the same routine every time:

1. Identify the evidence source
2. Find the unusual field, volume, or pattern
3. Match it to the likely attack
4. Check a second source to confirm it

A wireless scan is a good example. If a network name looks familiar but the access point identity does not match the trusted one, that points to an evil twin.

Wireless scan showing a possible evil twin

Common attack indicators:

• Evil twin
  Suspiciously similar SSID, or same SSID with an unexpected AP identity or location. Confirm with a wireless scan and locate by signal triangulation.
• Jamming
  Devices in one area cannot connect, and a scan shows electromagnetic noise in the wireless range.
• ARP poisoning
  Unusual ARP traffic, especially duplicate MAC-related ARP messages. Check the gateway’s ARP table for one MAC tied to multiple IPs.
• MAC flooding
  Sudden surge of Ethernet frames with many different source MACs. Check the switch MAC table for rapid MAC learning or capacity warnings.
• DNS poisoning
  Hard to spot directly. An abrupt unexplained drop in website traffic can point you to altered DNS records.
• Smurf attack
  Sudden increase in ICMP echo requests sent to a broadcast address.
• General network IoCs
  Connections to known malicious IPs, unauthorized scans, unusual spikes or slowdowns, and mismatched port-application traffic like SSH on port 443.