Packet analysis for network forensics: A comprehensive survey

被引：42
|
作者：
Sikos, Leslie F. [1 ]
机构：
[1] Edith Cowan Univ, Joondalup, Australia
来源：
FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION | 2020年 / 32卷
关键词：
Packet analysis; Deep packet inspection; Network forensics; Packet sniffer; Wireshark; Pcap; Digital evidence; Network monitoring; Intrusion detection; PERFORMANCE; IDENTIFICATION; INSPECTION; MARKING; SCHEMES; TOOL; DPI;
D O I：
10.1016/j.fsidi.2019.200892
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
Packet analysis is a primary traceback technique in network forensics, which, providing that the packet details captured are sufficiently detailed, can play back even the entire network traffic for a particular point in time. This can be used to find traces of nefarious online behavior, data breaches, unauthorized website access, malware infection, and intrusion attempts, and to reconstruct image files, documents, email attachments, etc. sent over the network. This paper is a comprehensive survey of the utilization of packet analysis, including deep packet inspection, in network forensics, and provides a review of AI-powered packet analysis methods with advanced network traffic classification and pattern identification capabilities. Considering that not all network information can be used in court, the types of digital evidence that might be admissible are detailed. The properties of both hardware appliances and packet analyzer software are reviewed from the perspective of their potential use in network forensics. (C) 2019 The Author. Published by Elsevier Ltd.
引用
收藏
页数：12
相关论文
共 50 条
  • [21] PACKET RADIO NETWORK ROUTING ALGORITHMS - A SURVEY
    HAHN, JJ
    STOLLE, DM
    [J]. IEEE COMMUNICATIONS MAGAZINE, 1984, 22 (11) : 41 - 47
  • [22] A Comprehensive Collection and Analysis Model for the Drone Forensics Field
    Alotaibi, Fahad Mazaed
    Al-Dhaqm, Arafat
    Al-Otaibi, Yasser D.
    Alsewari, Abdulrahman A.
    [J]. SENSORS, 2022, 22 (17)
  • [23] Comparative survey of local honeypot sensors to assist network forensics
    Chen, PT
    Laih, CS
    Pouget, F
    Dacier, M
    [J]. FIRST INTERNATIONAL WORKSHOP ON SYSTEMATIC APPROACHES TO DIGITAL FORENSIC ENGINEERING, PROCEEDINGS, 2005, : 120 - 132
  • [24] Challenges on Digital Cyber-Security and Network Forensics: A Survey
    Al-Sanjary, Omar Ismael
    Ahmed, Ahmed Abdullah
    Mohammed, M. N.
    Aik, Kevin Loo Teow
    [J]. ADVANCES ON INTELLIGENT INFORMATICS AND COMPUTING: HEALTH INFORMATICS, INTELLIGENT SYSTEMS, DATA SCIENCE AND SMART COMPUTING, 2022, 127 : 524 - 537
  • [25] A Comprehensive Review on Adaptability of Network Forensics Frameworks for Mobile Cloud Computing
    Khan, Suleman
    Shiraz, Muhammad
    Wahab, Ainuddin Wahid Abdul
    Gani, Abdullah
    Han, Qi
    Rahman, Zulkanain Bin Abdul
    [J]. SCIENTIFIC WORLD JOURNAL, 2014,
  • [26] An Empirical Study of Network Forensics Analysis Tools
    Ghafarian, Ahmad
    [J]. PROCEEDINGS OF THE 9TH INTERNATIONAL CONFERENCE ON CYBER WARFARE AND SECURITY (ICCWS-2014), 2014, : 366 - 370
  • [27] Attack Intention Analysis Model for Network Forensics
    Rasmi, M.
    Jantan, Aman
    [J]. SOFTWARE ENGINEERING AND COMPUTER SYSTEMS, PT 2, 2011, 180 : 403 - 411
  • [28] Understanding Network Forensics Analysis in an Operational Environment
    Raftopoulos, Elias
    Dimitropoulos, Xenofontas
    [J]. IEEE CS SECURITY AND PRIVACY WORKSHOPS (SPW 2013), 2013, : 111 - 118
  • [29] Building evidence graphs for network forensics analysis
    Wang, W
    Daniels, TE
    [J]. 21ST ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE, PROCEEDINGS, 2005, : 229 - 239
  • [30] Network Security Approach for Digital Forensics Analysis
    Achi, H.
    Hellany, A.
    Nagrial, M.
    [J]. ICCES: 2008 INTERNATIONAL CONFERENCE ON COMPUTER ENGINEERING & SYSTEMS, 2007, : 263 - 267
12345