A Proposed Method for Obfuscation of Malicious Traffic in a Compromised Network Using a Wireshark Simulator
Belal Ahmad Ayyoub · International Review on Modelling and Simulations (IREMOS) · 2024
The importance of information security has become very critical in the era of digital transformation, especially as encryption processes become more complex, and thus, in return, there is a stronger willingness on the part of saboteurs to penetrate them. This paper presents an obfuscation method to hide traffic and simulate stealth penetration of computer networks by creating a dropper to execute client instructions directly in memory to avoid static anti-virus analysis when the server code sends encrypted shell commands to the client code (in the victim machine) which will execute the shell command and encrypt the output, before sending it back to the attacker's server code. The Advanced Encryption Standard (AES) encryption algorithm has been used due to its strength and durability, and it is not easy to decrypt, especially with the activation of the Cipher block chaining CBC and choosing a random initiation vector value. The Wireshark latest version simulation program has been used for monitoring traffic by applying the proposed method model, which has been developed by using Python language. The results have demonstrated the effectiveness of the possibility of using it in computer network security operations.