Packet analysis for network forensics: A comprehensive survey

被引：47
作者：
Sikos, Leslie F. [1 ]
机构：
[1] Edith Cowan Univ, Joondalup, Australia
来源：
FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION | 2020年 / 32卷
关键词：
Packet analysis; Deep packet inspection; Network forensics; Packet sniffer; Wireshark; Pcap; Digital evidence; Network monitoring; Intrusion detection; PERFORMANCE; IDENTIFICATION; INSPECTION; MARKING; SCHEMES; TOOL; DPI;
D O I：
10.1016/j.fsidi.2019.200892
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
Packet analysis is a primary traceback technique in network forensics, which, providing that the packet details captured are sufficiently detailed, can play back even the entire network traffic for a particular point in time. This can be used to find traces of nefarious online behavior, data breaches, unauthorized website access, malware infection, and intrusion attempts, and to reconstruct image files, documents, email attachments, etc. sent over the network. This paper is a comprehensive survey of the utilization of packet analysis, including deep packet inspection, in network forensics, and provides a review of AI-powered packet analysis methods with advanced network traffic classification and pattern identification capabilities. Considering that not all network information can be used in court, the types of digital evidence that might be admissible are detailed. The properties of both hardware appliances and packet analyzer software are reviewed from the perspective of their potential use in network forensics. (C) 2019 The Author. Published by Elsevier Ltd.
引用
收藏
页数：12
相关论文
共 88 条
  • [1] Afanasyev M, 2011, COMMUN ACM, V54, P78, DOI [10.1145/1941487.1841508, 10.1145/1941487.1941508]
  • [2] The Performance Analysis of Honeypot Based Intrusion Detection System for Wireless Network
    Agrawal N.
    Tapaswi S.
    [J]. International Journal of Wireless Information Networks, 2017, 24 (1) : 14 - 26
  • [3] Novel hybrid schemes employing packet marking and logging for IP traceback
    Al-Duwairi, B
    Govindarasu, M
    [J]. IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, 2006, 17 (05) : 403 - 418
  • [4] Alhawi OMK, 2018, ADV INFORM SECUR, V70, P93, DOI 10.1007/978-3-319-73951-9_5
  • [5] Identification of VoIP encrypted traffic using a machine learning approach
    Alshammari, Riyad
    Zincir-Heywood, A. Nur
    [J]. JOURNAL OF KING SAUD UNIVERSITY-COMPUTER AND INFORMATION SCIENCES, 2015, 27 (01) : 77 - 92
  • [6] Alsmadi I., 2018, PRACTICAL INFORM SEC, P245, DOI [10.1007/978-3-319-72119-4_11., DOI 10.1007/978-3-319-72119-4_11]
  • [7] [Anonymous], 2011, ADV DIGITAL FORENSIC, VVII, P195, DOI [10.1007/978-3-642-24212-0_15., DOI 10.1007/978-3-642-24212-0_15]
  • [8] Ansari S, 2002, IEEE POTENTIALS, V21, P17, DOI 10.1109/MP.2002.1166620
  • [9] Bellovin S.M., 2000, Icmp traceback messages
  • [10] Ben-Asher N., 2015, Proceedings of the Tenth Conference on Semantic Technology for Intelligence, Defense, and Security, P34
123456789