Objectives

Objectives

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>(a) To study ne= twork forensics on network traffic packets from a session-level perspective. These include:

(1) Capturing of network traffic data packets.

(2) Organizing t= he packets into individual sessions.

(3) Displaying of traffic patterns between computers.

Note: Most tools focus on network forensics at packet-level and cannot detect malicious act in the form of a sequence inside a legitimate stream of packe= ts.

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>(b) To study on= the possibilities of integrating fast indexing and queries on the captured traf= fic history and implement it.

Note: Background on Netw= ork Forensics can be found at the last 2 pages

Plan

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>(1) Use tcpdump or Snort to collect the network traffic.

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>(2) Extract information from the collected traffic raw data.

Alternative I=

Use the parse graph as = shown on page 2 to build a simple parser for the input.

- = The parser can be easily extended to cater= on other new protocols.

- = It may be easily extended into recognizing email messages, pdf files.

Alternative I= I

= Use strings and grep to get information out from the tcpdump file.

- = "dsniff" can be incorporated to cater what A= lternative I can offer.

= <= /span>

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>(3) Group the p= ackets into individual sessions, extract files from the sessions and construct them into their original state.

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>(4) Explore on integrating fast indexing techniques on the stored objects for faster execu= tion of queries.

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>(5) Build a sim= ple queries parser.

Figure 1 Parse Graph (Adapted from Network Forensics Analysis by Vicka Corey)

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana'>=

Network Forensics

It is the use of scientifically proven techniques to collect, fuse, identify, examine, correlate, analyze, and document digital evidence from multiple, actively processing and transmitti= ng digital sources for the purpose of uncovering facts related to the planned intent, or measured success of unauthorized activities meant to disrupt, corrupt, and or compromise system components as well as providing informati= on to assist in response to or recovery from these activities.

<= span style=3D'font-size:10.0pt;line-height:150%;font-family:Verdana;mso-fareast-= font-family: Verdana;mso-bidi-font-family:Verdana'>- = Adapted from Modeling the Network Forensics Behaviors by Wei= Ren, Hai Jin

Normally, the focus of network forens= ics is to find out the cause of the incident and how to re-enact the process. <= o:p>

Common problems in Network Forensics

(1) Lack of storage of network p= ackets for large bandwidth network

-&nb= sp; = A common network forensic device, with 1 Tetra Byte storage, can only store 4= .6 days of data for 10% usage of a 100-Mbit/s WAN circuit

Source from Network Forensic Technologies Utilizing Communication

= &nb= sp; inform= ation by Takemi = Nisase, page 4, paragraph 1

(2) Slow gathering of evidences = from the large archive of network

(3) Some evidences can only be obtained from ISPs.

-&nb= sp; E.= g Backtracking the route of the susp= ected packet

(4) Encryption of network traffi= c

-&nb= sp; = Encryption of network makes network forensics tool hard to analyze encrypted packet contents.

(5) False positives

-&nb= sp; = Sometimes normal network activity may look like attack activity.

Integrating indexing techniques on the mammoth amount of traffic data=

Swish-E indexing=

This is about indexing files but not binary types. It's efficiency is faster than mySQL when the collec= tion size reaches more than 1 Gigabytes. For 5 gigabytes collection, swish-e took less than 1 second compared to 14 seconds taken by myS= QL.

- Source from Indexing Arbit= rary Data with SWISH-E by Josh Rabinowitz=

Sources of Evidence

Adapted from Modeling the Network Forensics Behav= iors by Wei Ren, Hai Jin

Focus of this project

The focus o= f this project will be on collecting and analyzing network traffic data packets. T= he process will be integrated with fast indexing techniques for faster queries execution.