Application of Artificial Intelligence to Network Forensics: Survey, Challenges and Future Directions

Abstract

Network forensics focuses on the identification and investigation of internal and external network attacks, the reverse engineering of network protocols, and the uninstrumented investigation of networked devices. It lies at the intersection of digital forensics, incident response and network security. Network attacks exploit software and hardware vulnerabilities and communication protocols. The scope of a network forensic investigation can range from Internet-wide down to a single device's network traffic. Network analysis tools (NATs) aid security professionals and law enforcement in the capturing, identification and analysis of network traffic. However, in most instances, the sheer volume of data to be analyzed is enormous and, despite some built-in NAT automation, the investigation of network traffic is often an arduous process. Furthermore, significant expert time remains wasted in the investigation of a high frequency of false positive alerting from automated systems. To address this globally impacting problem, artificial intelligence based approaches are becoming increasingly employed to automatically detect attacks and increase network traffic classification accuracy. This paper provides a comprehensive survey of the state-of-the-art in network forensics and the application of expert systems, machine learning, deep learning, and ensemble/hybrid approaches to a range of application areas in the field. These include network traffic analysis, intrusion detection systems, Internetof-Things devices, cloud forensics, DNS tunneling, smart grid forensics, and vehicle forensics. In addition, the current challenges and future research directions for each of the aforementioned application areas is discussed.

Network intrusion detection system by learning jointly from tabular and text‐based features

“…Rizvi introduced a deep learning approach for intrusion detection in resource-constrained environments, achieving high accuracy (Rizvi et al, 2023). Panigrahi provided a comprehensive assessment of supervised classifiers for designing NIDS, identifying the J48 Consolidated classifier as ideal (Panigrahi et al, 2021).…”

An Innovative Intrusion Detection System for High-Density Communication Networks Using Artificial Intelligence

“…Intrusion detection is critical for high-density communications systems because the large number of devices and users makes it easier for malicious actors to gain access and take advantage of weak points in the system [12]. The challenge of intrusion detection in high-density communications systems can be addressed with the use of big data analytics and machine learning algorithms [13]. In addition to the use of big data analytics and machine learning algorithms, the security of high-density communications systems can be further strengthened with the use of encryption and authentication methods.…”

MC-MLDCNN: Multichannel Multilayer Dilated Convolutional Neural Networks for Web Attack Detection

“…Dilated CNNs were recently used by Rizvi et al for an intrusion detection system [52]. Numerous successive dilated CNN layers without including any max-pooling layer are applied along with some feature engineering in the proposed model.…”