A Generic Framework for Network Forensics

Abstract

Internet is the most powerful medium as on date, facilitating varied services to numerous users. It has also become the environment for cyber warfare where attacks of many types (financial, ideological, revenge) are being launched. The ecommerce transactions being carried out online are of major interest to cybercriminals. The Internet needs to be protected from these attacks and an appropriate response has to be generated to handle them to reduce the impact. Network forensics is the science that deals with capture, recording, and analysis of network traffic for investigative purpose and incident response. There are many tools which assist in capturing data transferred over the networks so that an attack or the malicious intent of the intrusions may be investigated. This paper presents a generic framework for network forensic analysis by specifically identifying the steps connected only to network forensics from the already proposed models for digital investigation. Each of the phases in the framework is elucidated. A comparison of the proposed model is done with the existing models for digital investigation. Research challenges in various phases of the model are approached with specific reference to network forensics.

Challenges in network forensics

“…Network forensics analyses the traffic data logged through firewalls or intrusion detection systems or at other network devices such as routers. The goal is to trace back to the source of the attack in order to discover perpetrators [9]. One note has to be emphasized; the traffic or data which is being monitored is live so in network forensics we are no longer talking about postmortem analysis.…”

“…Data for forensic analysis can be collected from various security products which are placed onto the network to detect and prevent intrusions. Network forensics ensures that the attacker spends more time and energy to cover his tracks making the attack costly and time consuming [9].…”

An Anatomy for Recognizing Network Attack Intention

“…Therefore, there are various frameworks and techniques have been proposed in order to investigate the digital evidence. Pilli et al [6] had shown ubiquitous research survey on network forensics and proposed a generic framework for the network forensics investigation [7]. This proposed framework describes many of the phases that already have been proposed in the various digital forensics models but some new phases have been added specifically [8], [9], [10].…”

Network Forensics Framework Development using Interactive Planning Approach

“…In another research, some studies focus on problem-solving related attack patterns, log analysis, and data fusion techniques in understanding the relationship of any data [11]. This study is a combination of other studies that specifically examined the associated network framework.Suggested a generic framework of network investigation with nine phases are preparation and authorization, detection of incident/crime, incident response, the collection of network traces, preservation late protection, examination, analysis, investigation and attribution, and presentation and review.…”