A method for forensic artefact collection, analysis and incident response in environments running session initiation protocol and session description protocol
This source preferred by Vasilis Katos
This data was imported from Scopus:
Authors: Psaroudakis, I., Katos, V., Saragiotis, P. and Mitrou, L.
Journal: International Journal of Electronic Security and Digital Forensics
Copyright © 2014 Inderscience Enterprises Ltd. In this paper, we perform an analysis of SIP, a popular voice over IP (VoIP) protocol and propose a framework for capturing and analysing volatile VoIP data in order to determine forensic readiness requirements for effectively identifying an attacker. The analysis was performed on real attack data and the findings were encouraging. It seems that if appropriate forensic readiness processes and controls are in place, a wealth of evidence can be obtained. The type of the end user equipment of the internal users, the private IP, the software that is used can help build a reliable baseline information database. On the other hand the private IP addresses of the potential attacker even during the presence of NAT services, as well as and the attack tools employed by the malicious parties are logged for further analysis.