A Configurable Rule-Based Platform for Attack-Triggered PCAP Segmentation and Session-Level Multi-Protocol Feature Extraction

Post-attack traffic analysis usually chains separate tools for detection, PCAP splitting and feature extraction. This paper presents a configurable rule-based platform that integrates these steps. Stage 2 locates attack intervals with one of five detection modes and writes each interval as a self-contained PCAP file by byte offset; Stage 3 reconstructs bidirectional sessions and extracts 49 features, including TLS, DNS and HTTP fields and payload entropy. Only the TCP-flag mode (Mode 4) was evaluated, on CICDDoS2019 and two CICIDS-2017 captures. Session precision was 99.52% for SYN flood traffic. For PortScan and DoS, the cross-session rules classified 20,821 and 167,305 sessions without false positives, but precision over all Stage 3 sessions was 21.05% and 75.88%, and session recall was 13.1% and 66.2%. The DoS settings detected no attack in CSE-CIC-IDS2018 without retuning. A single-pass implementation of the segmentation produced the same attack-interval files as the original remainder-file loop and processed the 8.07 and 12.28 GiB captures end to end in 363 and 369 s with a peak resident memory of about 1.1 GB. The work is a system contribution for building forensic attack-interval datasets; its rules require tuning for each attack type and corpus.