Slide title

In CAPITALS

50 pt

Slide subtitle

32 pt

Muhammad Rizwan Asghar

October 23, 2019

COURSE RECAP AND EXAM INFO

Lecture 36

COMPSCI 726

Network Defence and Countermeasures

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

2

COURSE STRUCTURE:

FIRST HALF

Lectures (Week 1 to Week 7)

– Introduction

– Cryptography and PKI

– Network models

– SSL/TLS

– DNS and DNSSEC

– DoS and DDoS

– Firewall

– IDS and honeypot

– IPv4, IPv6, and IPSec

– Infrastructure platform protocols

BGP, SDN, and WiFi security

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

3

COURSE STRUCTURE:

SECOND HALF

Individual seminars by students

– 34 seminars

– 14 unique research articles – latest from CORE A* venues

Guest lecture by Ian White from ZX Security

Course recap and exam info

– Focus of this lecture!

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

4

EXPECTED FROM STUDENTS

Attend lectures and seminars

Active class participation

Present a research article

Review a presentation

Proposal (1 paragraph) and final report (7-10 pages)

– Come up with novel research ideas

– Group size 2

17 reports by 34 students

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

5

MY TEACHING PHILOSOPHY

Giving feedback to you

Sharing my knowledge and experience

Creating an environment where I can offer you

enough learning opportunities

Encouraging inclusiveness

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

6

SUPPORT DURING THIS COURSE

Discussion for selecting an article for seminar

Feedback on research proposal

Feedback on interim report

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

7

FUTURE POSSIBLITIES

Extending report as a research article

Thesis/dissertation

Internship

Job

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

8

LEARNING OUTCOMES

Give basic advice on securing communication networks (Themes

1-6*)

Criticise and appreciate technical literature on network security

(Themes 1-5*)

Demonstrate technical skills to increase security of communication

networks (Themes 1-6*)

Prepare and deliver an oral presentation on an advanced topic in

network security (Themes 1, 2, 4, and 5*)

Develop novel problem solving and research-informed ideas

(Themes 1-6*)

*All the themes are defined in graduate profiles

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

9

ASSESSMENTS

15% individual seminar

25% group report

60% final exam

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

10

EXAM

Study material for final exam

– Lecture slides and resources

– Seminars and class discussions

Closed book

8 questions

– Some questions have sub-questions (i.e., a, b, and c)

– You have to answer all the questions and sub-questions

60 marks

2 hours

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

11

OUR FEEDBACK

Seminars

– Seminars are being evaluated

– Grades and comments will be provided soon

Group reports

– Under evaluation

The feedback by us will be

– Consolidated feedback

– Covering constructive feedback by your audience

If applicable

– Incorporating bonus marks for active class participation

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

12

YOUR FEEDBACK:

SET EVALUATIONS

34 students

8 responded

Response rate: 23.53%

Thanks to those who already responded!

Request all other students to help us in achieving our

target of 80% by Sunday, October 27

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

13

SAMPLE QUESTION: Q1

Briefly describe one basic countermeasure to minimise IP

spoofing attacks. (2 marks)

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

14

SAMPLE ANSWER: A1

Let’s assume our university network. We can check that

the packets leaving the UoA network have the right

source IP, i.e., the public IP address of UoA.

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

15

SAMPLE QUESTION: Q2

User privacy in Domain Name Server (DNS).

a) Describe how DNS queries may compromise user

privacy. [4 marks]

b) Propose an approach for enabling DNS users to

protect their privacy against eavesdroppers and

privacy-invasive DNS servers. [4 marks]

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

16

SAMPLE ANSWER: A2

a) Describe how DNS queries may compromise user

privacy. [4 marks]

It is true that DNS maintains public information, which

does not compromise any user privacy unless no queries

are made. However, a DNS server can compromise user

privacy by monitoring DNS queries made by the user. The

DNS server can learn how many queries are made by the

user in a given time, time when the queries made, etc.

From that, the DNS server can infer user interests.

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

17

SAMPLE ANSWER: A2

b) Propose an approach for enabling DNS users to protect

their privacy against eavesdroppers and privacy-invasive

DNS servers. [4 marks]

The naive solution is to download all the DNS entries.

However, this solution is not efficient. The user can use

SSL/TLS for protecting queries from an eavesdropper.

However, a DNS server can still learn all the queries.

One approach could be making k number of queries,

where k > 1 and at least one query is the real one and the

rest of the queries are fake so that the DNS server or

eavesdropper cannot learn the actual query. Using this

approach, together with SSL/TLS, we can achieve user

privacy.

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

18

SAMPLE QUESTION: Q3

Recall the article “Signal Characteristic-Based Sender

Identification and Intrusion Detection in Automotive

Networks”.

a) Briefly explain how do different Electrical Control Units

(ECUs) identify messages from each other. [2 marks]

b) Describe what might go wrong if a message from an

ECU is not correctly identified. [2 marks]

c) Outline a solution to verify authenticity of messages

from ECUs. [4 marks]

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

19

SAMPLE ANSWER: A3

a) Briefly explain how do different Electrical Control Units

(ECUs) identify messages from each other. [2 marks]

Each ECU includes a unique 11-bit ID in a frame that is

transmitted over the Controller Area Network (CAN).

Using this ID, an ECU can be identified…

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

20

SAMPLE ANSWER: A3

b) Describe what might go wrong if a message from an

ECU is not correctly identified. [2 marks]

CAN does not provide any mechanisms to verify

authenticity of a message. Every participant on the CAN

bus can easily spoof identifiers. Compromised ECUs can

send fake frames, thus threatening safety critical

functions.

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

21

SAMPLE ANSWER: A3

c) Outline a solution to verify authenticity of messages

from ECUs. [4 marks]

Read [Kneib-CCS18] …

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

22

CANVAS, COURSE WEBSITE,

AND PIAZZA

Canvas for almost everything

All lectures were recorded and recording links were

distributed through Canvas

Canvas (week/lecture wise organisation)

– https://canvas.auckland.ac.nz/courses/38264/modules

Course website (topic wise organisation)

– https://www.cs.auckland.ac.nz/courses/compsci726s2c

Piazza

– https://piazza.com/aucklanduni.ac.nz/semester22019/compsci726

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

23

Questions?

Thanks for your attention!