Hierarchy Website Fingerprint Using N-gram Byte Distribution

Mohammed Aldarwbi,Essa Shahra

doi:10.14738/tnc.56.3767

Abstract

According to www.internetlivestats.com, there are over 1 billion websites on the world wide web (WWW) today while in 1991, there were only one single website. Websites classification based on traffic analysis has become a difficult problem due to the large number of websites within the internet. All the proposed approaches in the literature could not classify more than 100 websites which is a very trivial number compared to the total number of websites over the internet. In this paper, a two-level websites’ classification technique is proposed. At the first level, the traffic is classified to a general category such as sports, news, social, healthy, education, etc. Then, for further information the packet could be classified within the same category to identify from which websites the packet came.

Highlights

Digital forensics is considering as extremely youthful science as the number digital crimes have been increased dramatically
The new emerging digital forensics issues needs creative solutions to be utilized by the investigators to achieve their work in the optimal way
Network forensics issues are considered as the most difficult issues in digital forensics as investigator endeavors to recreate or comprehend occasions from the data observed in the network

Summary

Introduction

Digital forensics is considering as extremely youthful science as the number digital crimes have been increased dramatically. Network forensics enables us to make measurable decisions in view of the captured traffic, which might be significant over the span of an investigation [1]. Network administrators use network forensic analysis tools (NFAT) to monitor network, capture network traffic, play main role in network crime investigation to assist and help in generating appropriate decision of an incident. Website fingerprint is an attack of traffic analysis running by a local eavesdropper, its goal is to infer information about the visited website by user by defining a feature of data flow. A two-level website classification technique is presented. The second level of classification can be used for further information; the packet could be classified within the same category to identify from which websites the packet came. Experiments and analysis is presented in section 5. the conclusion of our work

Related Work

N-gram Distribution

Data Collection

Implementations

Findings

Conclusion