◇ OpenCyber Academy
Engineering · Chapter 11 · English

Chapter 11 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Networks and protocols

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 TAXII over HTTPS"]
  N2["11.2 DNS in intelligence"]
  N3["11.3 NAT and shared hosting"]
  N4["11.5 Ports and protocols in ATT&CK"]
  N5["Practice note — Pagination and completeness"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 TAXII over HTTPS"]
  N2["11.2 DNS in intelligence"]
  N3["11.3 NAT and shared hosting"]
  N4["11.5 Ports and protocols in ATT&CK"]
  N5["Practice note — Pagination and completeness"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 TAXII over HTTPS]
    |
    v
[11.2 DNS in intelligence]
    |
    v
[11.3 NAT and shared hosting]
    |
    v
[11.5 Ports and protocols in ATT&CK]
    |
    v
[Practice note — Pagination and completeness]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) explain HTTPS as the transport for TAXII 2.1; (2) read DNS records relevant to indicators; (3) understand how network address translation and shared hosting affect attribution; (4) configure collection to respect rate limits.

11.1 TAXII over HTTPS

TAXII 2.1 is a RESTful API over HTTPS. Clients discover API roots, list collections and get or add objects with pagination. Mutual authentication and TLS protect the channel; the TAXII specification defines the endpoints and media types, not the trust relationships, which come from agreements.

For Lantern this means a partner's server presents a certificate that Kofi's collector checks, and the collector presents its own certificate so the partner knows who is asking. Which collections BEN may read is set by the sharing agreement and enforced by the partner. A valid connection does not make the content trustworthy; it only shows where it came from.

11.2 DNS in intelligence

A domain indicator resolves through DNS to addresses that may change hourly. A records, CNAMEs and name servers each tell a different story. Passive DNS — historical resolution data from licensed providers — shows how infrastructure moved.

Kofi records the time of every resolution Lantern performs, because an answer without a time cannot be compared with anything. A domain that pointed at a hostile address last month may point at a parked page today. Passive DNS lets an analyst ask what the domain resolved to on the day of a sighting, which is the question an investigation usually needs answered. The provider's licence limits how long that history may be kept, and Lantern follows it.

11.3 NAT and shared hosting

Many devices can sit behind one public address; many websites can share one hosting address. Blocking such an address can cause collateral damage, and associating everything behind it with an adversary is a classic analytic mistake.

BEN met this when a partner listed an address used by a cloud provider's shared gateway. Blocking it would have cut off several services that BEN depends on. The worked example shows the safer route: block the specific domain at the DNS layer, where it does not affect other tenants, and record why the address was not blocked. Analysts should say that an address hosted hostile content, not that it belongs to the adversary.

11.4 Rate limits and politeness

Collection from partner TAXII servers follows their published limits. Back off on HTTP 429 responses; never rotate identities to evade limits.

A response with that status asks the client to slow down, and many servers say how long to wait. Lantern's collector honours that value, doubles its wait on repeated refusals and stops after a set number of tries, raising an alert for an engineer. Using many accounts or addresses to get around a limit would break the agreement and damage BEN's standing with the partner. A collector that respects limits keeps its access; one that does not loses it.

11.5 Ports and protocols in ATT&CK

ATT&CK technique T1071 Application Layer Protocol describes adversaries communicating over common protocols to blend in. Network indicators alone therefore miss much command-and-control; behavioural analytics complement them.

An attacker who sends commands over ordinary web traffic to a fresh domain leaves no indicator Lantern already knows. What may still stand out is the pattern: regular check-ins at fixed intervals, unusual amounts of data or connections from a host that never browses. Kofi passes these analytics to the detection team as a complement to the indicator feeds rather than a replacement.

Practice note — Pagination and completeness

TAXII 2.1 responses can be paginated. A collector that reads only the first page will report success while missing most objects. Lantern follows the more and next indicators until the server reports completion, and records the count received per poll so that sudden drops become visible.

Worked example

Kofi sees that a partner's indicator resolves to an address shared by 3,000 websites at a hosting provider. He marks it "do not block at perimeter", forwards it for DNS-layer blocking of the specific domain instead, and documents the reason.

Synthetic case. The indicator and hosting count are invented.

Errors and limits

DNS answers vary by resolver and time. Never test partner endpoints beyond agreed use.

Exercises

Synthesis

TAXII rides on HTTPS, DNS tells time-dependent stories, shared addresses mislead, and polite clients back off.

Continue studying — chapter 11 of 50

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →