Network forensics: Review, taxonomy, and open challenges

Khan, Suleman; Gani, Abdullah; Wahab, Ainuddin Wahid Abdul; Shiraz, Muhammad; Ahmad, Iftikhar

doi:10.1016/j.jnca.2016.03.005

Cited by 102 publications

(52 citation statements)

References 83 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…According to recent surveys, the storage and privacy problems are still open challenges in network forensics [15], [16]. Our analysis and experiments, presented in this paper, show that the previous payload attribution systems result in a high false positive rate for the flow determination step; hence, many flows are falsely reported as the excerpt carriers.…”

Section: Introductionmentioning

confidence: 82%

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

Hosseini

Jahangir

2018

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

1  Abstract-Payload Attribution Systems (PAS) are one of the most important tools of network forensics for detecting an offender after the occurrence of a cybercrime. A PAS stores the network traffic history in order to detect the source and destination pair of a certain data stream in case a malicious activity occurs on the network. The huge volume of information that is daily transferred in the network means that the data stored by a PAS must be as compact and concise as possible. Moreover, the investigation of this large volume of data for a malicious data stream must be handled within a reasonable time. For this purpose, several techniques based on storing a digest of traffic using Bloom filters have been proposed in the literature. The false positive rate of existing techniques for detecting cybercriminals is unacceptably high, i.e., many source and destination pairs are falsely determined as malicious, making it difficult to detect the true criminal. In order to ameliorate this problem, we have proposed a solution based on compressed bitmap index tables and traffic downsampling. Our analytical evaluation and experimental results show that the proposed method significantly reduces the false positive rate.

show abstract

Section: Introductionmentioning

confidence: 82%

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

Hosseini

Jahangir

2018

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…Nonetheless, there are some challenges to forensics procedures when dealing with network security evidence [35]. Due to the high transmission rate in networks, data is generated very fast, enforcing the necessity to have large storage capacity devices.…”

Section: Network Forensicsmentioning

confidence: 99%

“…Khan et al [35] also cite data integrity as a network forensics challenge. Digital evidence may be easily manipulated, either accidentally or not, compromising the validity of the evidence.…”

Section: Network Forensicsmentioning

confidence: 99%

Cybersecurity and Network Forensics: Analysis of Malicious Traffic towards a Honeynet with Deep Packet Inspection

et al. 2017

View full text Add to dashboard Cite

Any network connected to the Internet is subject to cyber attacks. Strong security measures, forensic tools, and investigators contribute together to detect and mitigate those attacks, reducing the damages and enabling reestablishing the network to its normal operation, thus increasing the cybersecurity of the networked environment. This paper addresses the use of a forensic approach with Deep Packet Inspection to detect anomalies in the network traffic. As cyber attacks may occur on any layer of the TCP/IP networking model, Deep Packet Inspection is an effective way to reveal suspicious content in the headers or the payloads in any packet processing layer, excepting of course situations where the payload is encrypted. Although being efficient, this technique still faces big challenges. The contributions of this paper rely on the association of Deep Packet Inspection with forensics analysis to evaluate different attacks towards a Honeynet operating in a network laboratory at the University of Brasilia. In this perspective, this work could identify and map the content and behavior of attacks such as the Mirai botnet and brute-force attacks targeting various different network services. Obtained results demonstrate the behavior of automated attacks (such as worms and bots) and non-automated attacks (brute-force conducted with different tools). The data collected and analyzed is then used to generate statistics of used usernames and passwords, IP and services distribution, among other elements. This paper also discusses the importance of network forensics and Chain of Custody procedures to conduct investigations and shows the effectiveness of the mentioned techniques in evaluating different attacks in networks.

show abstract

“…A discussion of network forensic investigation in cloud computing environments can be found in [39,42]. A list of open problems can be found in [21], although not regarding the special characteristics of virtual networks.…”

Section: Related Workmentioning

confidence: 99%

Challenges of Network Forensic Investigation in Virtual Networks

Spiekermann

Eggendorfer

2017

JCSM

View full text Add to dashboard Cite

The evolution of virtualization techniques is changing operating principles in today's datacenters. Virtualization of servers, networks and storage increases the flexibility and dynamic of the environment by reducing the administrative overhead. Based on a physical underlay network, different logical networks are implemented with new protocols like VXLAN, STT or GENEVE. New paradigms like Software-Defined-Networks or Network Function Virtualization offer new capabilities to redesign the whole network infrastructure. This trend creates new challenges for digital investigations analysing incidents by extracting and interpreting recorded data inside the environment. As a branch of digital investigation, network forensic investigation is used to examine network traffic by capturing the data of a suspicious target system and analysing this data. In this article, we analyse in detail new challenges in investigating virtual networks. We propose a classification in three categories, which might help to develop new methods and possible solutions to simplify further necessary investigations in virtual network environments. The defined challenges are classified according their potential to impede the investigation. Based on this classification we derive a list of basic conditions, describing different necessary requirements to implement a successful, valid and ongoing network forensic investigation in these virtual networks.

show abstract

Network forensics: Review, taxonomy, and open challenges

Cited by 102 publications

References 83 publications

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

An Effective Payload Attribution Scheme for Cybercriminal Detection Using Compressed Bitmap Index Tables and Traffic Downsampling

Cybersecurity and Network Forensics: Analysis of Malicious Traffic towards a Honeynet with Deep Packet Inspection

Challenges of Network Forensic Investigation in Virtual Networks

Contact Info

Product

Resources

About