i'm preparing my bachelor's degree, i have to chose an attack, sniffing, dos, or MIM attack, I'm a bit lost, in my project i have to find a solution, how to detect one of this attacks, If you guys may give me your opinion on which is the easiest one to detect that would be awesome. thank you
closed as primarily opinion-based by GdD, BadSkillz, Neil Smithline, Steffen Ullrich, Deer Hunter Feb 8 '16 at 16:09
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
To start off I would immediate research and acquire a firewall and a packet sniffer. This way you can analyze EACH packet coming into your system with a custom program that would be your project then you could go a step further and send the right API commands to the firewall to block a specific port or IP address.
DOS(Denial of Service)
This is probably your easiest to detect, it depends on what service you are getting denied. If your internet connection is getting disrupted a simple ping to a website like google might be plenty sufficient to tell. A few DOS attack are from an exploit that will confuse the service to the point of not being usable, which would require a look at the service that is being denied.
MIM (Man in the Middle)
This is probably the hardest to detect, I would suggest reading the answers here Can I detect a MITM attack?. In theory SSL and knowing the fingerprint before ever connecting, say from another IP address and route all together, then SSL should be able to warning you fairly well.
This would be testing by seeing if a Network Card is in Promiscuous Mode.
Perhaps more information regarding your project and what you are allowed to do in order to detect an attack, i.e. can you use any language you like, any system, and any attacker? This might provide a more focused direct question.