Network Forensics Research Articles

Comprehensive Study of Network Forensic

Today, as the cybercrimes are increasing rapidly, there is necessity to find the root cause of the loopholes that are left while taking care of cyber security. So, the evidences are searched to find the source of the cyber attack. This can be done by detecting networks and network components used by criminals which comes under network forensics. Network forensic is a domain of computer forensic which studies internal and external network to find out important artifacts for investigators to discover the origin of the cyber attack. The proposed survey focuses on overview of network forensic domain having different network forensic methods, methodology along with the analysis of network forensic tools (NFTs). The proposed survey also concentrates on the comparison of NFTs like Network Miner, Xplico, LogRhythm, NIKSUN, Nmap, etc. based on their features, compatibility with platforms, whether they are open source or commercial, etc. Finally, this paper concludes with the basic purpose and features of every tool and its usability.

A Detection and Investigation Model for the Capture and Analysis of Network Crimes

Investigation in the field of network forensics involves examining network traffic to identify, capture, preserve, reconstruct, analyze, and document network crimes. Although there are different perspectives on the practical and technical aspects of network forensics, there is still a lack of fundamental guidelines. This paper proposes a new detection and investigation model for capturing and analyzing network crimes, using design science research. The proposed model involves six processes: identification, verification, gathering, preservation, examination, analysis, and documentation. Each process is associated with several activities that provide the investigation team with a clear picture of exactly what needs to be performed. In addition, the proposed model has a unique activity, namely reporting. As a result, this model represents a comprehensive approach to network forensics investigations. It is designed to work in conjunction with established forensic techniques to ensure that forensic evidence from the network is collected and analyzed efficiently and effectively following accepted forensic procedures. The proposed model was compared with existing models in terms of completeness, showing that it is complete and can be adapted to any type of network and legal framework.

Enhanced neural network-based attack investigation framework for network forensics: Identification, detection, and analysis of the attack

Network forensics aids in the identification of distinct network-based attacks through packet-level analysis of collected network traffic. It also unveils the attacker's intentions and operations. After identification, it is inevitable to design an efficient network attack detection model. Therefore, this work modifies the generic network forensic framework for attack investigation with two primary objectives i.e., Analysis and detection of attacks. In the proposed framework, a three-level analysis is performed. First, packet-level analysis is performed to study the attack behavior. Second, a graphical analysis is completed to determine both the attack flow and whether a node is an attacker or a victim. Moreover, it also assigns a score to the node indicating the severity of the attack. Finally, forensics exploratory data analysis (FEDA) is performed to distinguish the distribution of different features during attack and normal scenarios. For attack detection, the framework uses a convolution neural network (CNN-1D). CSE-CIC-IDS2018 (CIC2018), UNSW-NB15 and CIC-Darknet2020 datasets are used to test the performance of the proposed framework, wherein, it classifies distinct classes of attacks with an accuracy of 99.4%, 99.0%, and 90% on each dataset respectively. The results show that the proposed framework is more effective than previous works in attack detection and network traffic classification.

Network Attacks Classification for Network Forensics Investigation: Literature Reviews

The computer network plays an important role in supporting various jobs and other activities in the cyber world. Various kinds of crimes have often occurred on computer networks. It is very demanding to build a computer network architecture that is safe from attacks to protect the data transacted. If there has been an attack on the computer network, of course, further investigation must be carried out to identify the attacker and the motive for the attack. An additional need is to evaluate the security of the network. This article reports a systematic review of the literature aiming to map the classification of attacks on computer networks and map future research. Based on the exploration, 30 key studies were selected that reveal the mapping of attack classifications on computer networks. The results of the literature review show that attacks on computer networks vary widely. Based on the results of the literature review conducted, it produces a roadmap for future research, which is to classify attacks on computer networks using a machine learning approach. The use of machine learning serves to help classify and investigate the needs for attacks on computer networks. The SVM method in this case was chosen based on previous research that was widely used for data-based classification.

Digital Communication Forensics in 6G and beyond Networks

6G networks can be truly intelligent wireless systems that have the flexibility for continuous technological improvements. However, security events affecting information systems have grown increasingly complicated and sophisticated. Intruders may be able to operate due to a lack of evidence authenticity. Using network forensics methods can solve many cybercrime instances. These methods can be used to locate the intruder and to determine the intrusion’s origin and how it can be avoided in the future. Existing network forensics techniques confront security threats and vulnerabilities in several networks, such as personal area networks, local area networks, wide area networks, and wireless wide area networks under telecom networks, in practice, but cannot operate in 6G and beyond telecom networks, which are critical at this moment. Thus, a comprehensive literature analysis of telecom networks is conducted to identify existing concerns and challenges in conducting digital communication forensics. Hence, a digital forensics system for 6G and beyond networks is proposed as an initial idea on the basis of the highlighted issues, thereby assessing security incidents and providing justified evidence that explains the footprints of the attackers.

Selection of efficient machine learning algorithm on Bot-IoT dataset for intrusion detection in internet of things networks

With the growth of internet of things (IoT) systems, they have become the target of malicious third parties. In order to counter this issue, realistic investigation and protection countermeasures must be evolved. These countermeasures comprise network forensics and network intrusion detection systems. To this end, a well-organized and representative data set is a crucial element in training and validating the system's credibility. In spite of the existence of multiple networks, there is usually little information provided about the botnet scenarios used. This article provides the Bot-IoT dataset that embeds traces of both legitimate and simulated IoT networks as well as several types of the attacks. It provides also a realistic test environment to address the drawbacks of existing datasets, namely capturing complete network information, precise labeling, and a variety of recent and complex attacks. Finally, this work evaluates the confidence of the Bot-IoT dataset by utilizing a variety of machine learning and statistical methods. This work will provide a foundation to enable botnet identification on IoT-specific networks.

A Complete Handbook for Digital Forensics Investigator

Abstract: This handbook provides a comprehensive guide to digital forensics, covering topics such as its definition and scope, importance in investigations, and legal and ethical considerations. It emphasizes the collection, analysis, and presentation of digital evidence while adhering to legal guidelines and ethical standards. Key topics include cybercrime investigations, incident response, privacy protection, chain of custody, and professional conduct. The handbook also covers tools, file systems, network forensics, malware analysis, mobile device forensics, and emerging challenges in the field

A knowledge-based system for supporting the soundness of digital forensic investigations

Performing a technically and legally sound digital forensic investigation leads to digital evidence that can be used in courts of law. However, there is no single model of a standardized procedure that investigators should abide by. This paper presents a knowledge-based system that formally specifies information about investigative procedures in accordance with standards and guidelines such as ISO/IEC 27037, ISO/IEC 27041, ISO/IEC 27042, ISO/IEC 27043, NIST’s Guide to Integrating Forensic Techniques into Incident Response and Interpol’s Guidelines for Digital Forensics First Responders. The knowledge base is created in a description logic and it represents an ontological model. The model unifies concepts from different standards and guidelines, thus enabling the system to aid investigators in executing investigative procedures that will result in admissible digital evidence. The paper uses network forensics as a case study, but it can be customized to other digital forensics domains.

OWASP Framework-based Network Forensics to Analyze the SQLi Attacks on Web Servers

One of dangerous vulnerabilities that attack the web is SQLi. With this vulnerability, someone can obtain user data information, then change and delete that data. The solution to this attack problem is that the design website must improve security by paying attention to input validation and installing a firewall. This study's objective is to use network forensic tools to examine the designlink website's security against SQLi attacks, namely Whois, SSL Scan, Nmap, OWASP Zap, and SQL Map. OWASP is the framework that is employed; it is utilized for web security testing. According to the research findings, there are 14 vulnerabilities in the design website, with five medium level, seven low level, and two informational level. When using SQL commands with the SQL Map tool to get username and password information on its web server design. The OWASP framework may be used to verify the security of websites against SQLi attacks using network forensic tools, according to the study's findings. So that information about the vulnerabilities found on the website can be provided. The results of this study contribute to forensic network knowledge against SQLi attacks using the OWASP framework as well as for parties involved in website security.

Using relational graphs for exploratory analysis of network traffic data

The human brain is designed to perceive the surrounding world as associations. These associations between the individual pieces of information allow us to analyze and categorize new inputs and thus understand them. However, the support for association-based analysis in traditional network analysis tools is only limited or not present at all. These tools are mostly based on manual browsing, filtering, and aggregation, with only basic support for statistical analyses and visualizations for communicating the general characteristics. Yet, it is the relationship diagram that could allow the analysts to get a broader context and reveal the associations hidden in the data. In this paper, we explore the possibilities of relational analysis as a novel paradigm for network forensics. We provide a set of user requirements based on the discussion with domain experts and introduce a novel visual analysis tool utilizing multimodal graphs for modeling relationships between entities from captured packet traces. Finally, we demonstrate the relational analysis process on two use cases and discuss feedback from domain experts.

DQNANFCT: design of a deep Q-learning network for augmented network forensics via integrated contextual trust operations

DQNANFCT: design of a deep Q-learning network for augmented network forensics via integrated contextual trust operations

Network Forensics and Incident Response

Network Forensics and Incident Response

XG-BoT: An explainable deep graph neural network for botnet detection and forensics

In this paper, we propose XG-BoT, an explainable deep graph neural network model for botnet node detection. The proposed model comprises a botnet detector and an explainer for automatic forensics. The XG-BoT detector can effectively detect malicious botnet nodes in large-scale networks. Specifically, it utilizes a grouped reversible residual connection with a graph isomorphism network to learn expressive node representations from botnet communication graphs. The explainer, based on the GNNExplainer and saliency map in XG-BoT, can perform automatic network forensics by highlighting suspicious network flows and related botnet nodes. We evaluated XG-BoT using real-world, large-scale botnet network graph datasets. Overall, XG-BoT outperforms state-of-the-art approaches in terms of key evaluation metrics. Additionally, we demonstrate that the XG-BoT explainers can generate useful explanations for automatic network forensics.

TAARA Method for Processing on the Network Forensics in the Event of an ARP Spoofing Attack

According to reports in 2021 by Kaspersky, requests for investigations into suspicious network activity, such as ARP Spoofing, which can result in sophisticated attacks, reached up to 22%. Several difficulties with examining network systems have been overcome thanks to network forensic investigations. This study aims to perform a network forensic analysis of ARP spoofing attacks using Wireshark forensic tools and Network Miner with a sniffer design process to capture traffic on the router side. In order to gather reliable evidence, this study employs the TAARA method as a network forensic investigation process. Based on the research conducted, it can be demonstrated that an attack took place from eight PCAP files. The information that was gathered, such as the IP address and MAC address of the attacker, the IP address and MAC address of the target, and the date and time of the attack are examples of evidence information that was gathered. This study also shows that network forensic operations can use the Wireshark forensic tool to obtain more detailed data.

FORENSIC NETWORK ANALYSIS AND IMPLEMENTATION OF SECURITY ATTACKS ON VIRTUAL PRIVATE SERVERS

ABSTRACT-PT Kodinglab Integrasi Indonesia's Virtual Private Server (VPS) product requires good quality standards, including security. The challenge that arises is still frequent disruptions to the protection of PT Kodinglab's VPS customers, where it is difficult to identify the source of the attack. Network forensics in the form of dead forensics and live forensics using the NIST method with the stages of collection, examination, Analysis, and reporting are used to find the source of the attack. Data for dead forensics comes from snort tools, and data for live forensics comes from capture Wireshark. The collection stage involves collecting attack data from snort logs and wireshark for life forensics. While the examination dataset stages are further analyzed and mapped. Advanced check on the server via syslog snort. From the attack testing carried out to obtain information in the form of the attacker's IP address, destination IP address, date of the attack, server time, and type of attack from testing the TCP Flooding and UDP Flooding attacks, all attacks on the customer's VPS can be identified. The information obtained regarding the attacker is in the form of the date and time the attack occurred, the attacker's IP address and the victim's IP address, and the protocol used. Kata kunci : Network Forensic, Dead Forensic, Live Forensic, Virtual Private Server, DDos, TCP Flooding, UDP Flooding.

PENERAPAN METODE NETWORK FORENSIK UNTUK ANALISIS SERANGAN DOS PADA PERANGKAT ROUTER

Digital forensics is a part of forensic science that covers the discovery and investigation of matter (data) found on digital devices. At present the use of computer technology is so rapid that it helps human activities with the sophistication of computer network technology, behind all of that problems arise regarding network forensics. The main cause of network forensic problems is the act of misuse of technology by irresponsible people with the aim of utilizing other parties' network facilities for personal or group interests. DoS attacks (Denial of Service) one of the most common attacks on computer networks is a type of network attack Router that cannot service user requests, and ultimately causes the computer network to be down . Kata Kunci − Digital Forensics, Network Forensics, DoS

Network Forensics Against Address Resolution Protocol Spoofing Attacks Using Trigger, Acquire, Analysis, Report, Action Method

This study aims to obtain attack evidence and reconstruct commonly used address resolution protocol attacks as a first step to launch a moderately malicious attack. MiTM and DoS are the initiations of ARP spoofing attacks that are used as a follow-up attack from ARP spoofing. The impact is quite severe, ranging from data theft and denial of service to crippling network infrastructure systems. In this study, data collection was conducted by launching an test attack against a real network infrastructure involving 27 computers, one router, and four switches. This study uses a Mikrotik router by building a firewall to generate log files and uses the Tazmen Sniffer Protocol, which is sent to a syslog-ng computer in a different virtual domain in a local area network. The Trigger, Acquire, Analysis, Report, Action method is used in network forensic investigations by utilising Wireshark and network miners to analyze network traffic during attacks. The results of this network forensics obtain evidence that there have been eight attacks with detailed information on when there was an attack on the media access control address and internet protocol address, both from the attacker and the victim. However, attacks carried out with the KickThemOut tool can provide further information about the attacker’s details through a number of settings, in particular using the Gratuitous ARP and ICMP protocols.

A Novel Approach to Network Forensic Analysis: Combining Packet Capture Data and Social Network Analysis

Log data from computers used for network forensic analysis is ineffective at identifying specific security threats. Log data limitations include the difficulty in reconstructing communication patterns between nodes and the inability to identify more advanced security threats. By combining traditional log data analysis methods with a more effective combination of approaches, a more comprehensive view of communication patterns can be achieved. This combined approach can then help identify potential security threats more effectively. It's difficult to determine the specific benefits of combining Packet Capture (PCAP) and Social Network Analysis (SNA) when performing forensics. This article proposes a new approach to forensic analysis that combines PCAP and social network analysis to overcome some of the limitations of traditional methods. The purpose of this discovery is to improve the accuracy of network forensic analysis by combining PCAP and social network analysis to provide a more comprehensive view of network communication patterns. Network forensics, which combines pcap analysis and social network analysis, provides more comprehensive results. PCAP analysis is used to analyze network traffic, conversation statistics, protocol distribution, packet content and round-trip times. Social network analysis maps communication patterns between nodes and identifies the most influential key players within the network. PCAP analysis efficiently captures and analyzes network packets, and SNA provides insight into relationships and communication patterns between devices on the network.

COMBINING DIGITAL FORENSICS WITH TRADITIONAL SAFETY MEASURES TO IMPROVE DATA SECURITY IN BANKING

This study aims to investigate a new method of forensic cybersecurity to improve data protection in the banking industry. The document is based on several experiments that demonstrate the effectiveness of digital forensics, combined with traditional banking security measures, as a reliable data security method. Banking data is a prime target for most cyber attackers, and securing this data has always been one of the most critical challenges in the banking industry, especially in modern society, where numerous money transfer systems have emerged. This research suggests and explains a more specialized security system that employs disk imaging, data carving, memory analysis, and network forensics to detect, investigate, and counteract cybercrimes against banking data. The authors illustrate how these techniques can combine with traditional security measures to improve banking data security and enhance forensic investigation processes. The method allows banking firms to improve the efficiency of incidence response, protect confidential information, improve risk management and adhere to government regulations. The researchers employed standardized scientific experiments that proved the effectiveness of this security enhancement method. Result analysis indicates that by implementing this method of forensic cybersecurity, bankers can reduce losses due to cyberattacks by at least 40%. They can also improve their customer’s trust, consequently maintaining a high client retention rate, helping firms boost profits by up to 30%. Besides its benefits to financial institutions, this research project contributes to the scientific literature on digital forensics and cybersecurity. Additionally, it provides practical solutions and suggestions that can be used in other data security subsectors. Keywords: Forensic Computer Science, Banking Data, Cybercrime, Digital Forensics, Data Security DOI： https://doi.org/10.35741/issn.0258-2724.58.2.29

Validation of Individual Identification Through Decision Tree Packet Header Profiling

The drastic rise in the cybercrime rate associated with the surge of users' dependence on the Internet has elevated the concern of digital forensic examiners toward the footprints of perpetrators left in a virtual environment. However, suspect identification is a big challenge in network forensics due to the anonymous nature of data transmission across the network. This study utilises the decision tree classification approach to characterise users from their behavioural web navigation pattern using the meta-data of captured network packets (Destination IP, Protocol, Port Source, and Port Destination). A total of 95,795,379 network packet headers from 96 subjects were successfully collected. Their meta-data header packets were statistically profiled to generate digital fingerprints that try to link their action on the network to their identity accurately. Hence, CHAID decision tree modelling using Destination IP, Unique protocols, and a combination of the two, including Port source and Port destination, resulted in an accuracy of 4.07%, 6.34%, and 6.36%, respectively. However, the modelling could not create a reliable decision tree for the Port source and destination. The validation study on all the combined variables had a similar accuracy of 6.36%, indicating model created had reproducibility capability. Despite the outcome, the proposed method is not yet sufficiently strong for suspect identification. Further enhancement to improve its accuracy is required.