AN IDENTITY AND INTERACTION-BASED APPROACH TO NETWORK FORENSIC ANALYSIS
Authors: Clarke, N., Alotibi, G., Joy, D., Li, F., Furnell, S., Alshumrani, A. and Mohammed, H.
Journal: Journal of Information Systems Security
Volume: 21
Issue: 2
Pages: 131-147
eISSN: 1551-0808
ISSN: 1551-0123
Abstract:In today’s landscape of increasing electronic crime, network forensics plays a pivotal role in digital investigations. It aids in understanding which systems to analyse and serves as a supplement to support evidence found through more traditional computer-based investigations. However, the nature and functionality of the existing Network Forensic Analysis Tools (N-FATs) fall short compared to File System Forensic Analysis Tools (FS-FATs) in providing usable data. Current N-FATs often present data at an overly granular level, making it challenging for investigators to extract meaningful insights in a timely manner. Moreover, the analysis tends to focus on IP addresses, which are not synonymous with user identities, a point of significant interest to investigators. This paper presents several experiments designed to create a novel N-FAT approach that can identify users and understand how they are using network-based applications whilst the traffic remains encrypted. The experiments build upon the prior art and investigate how effective this approach is in classifying users and their actions. Using an in-house dataset composed of 50 million packets, the experiments use three incremental developments for improving the performance. Building upon the successful experiments, a proposed N-FAT interface is presented to illustrate the ease with which investigators may ask relevant questions of user interactions. The experiments profiled across 27 users, has yielded an average 93.3% True Positive Identification Rate (TPIR), with 41% of users experiencing 100% TPIR. Skype, Wikipedia and Hotmail services achieved a notably high level of recognition performance. The study has developed and evaluated an approach to analyse encrypted network traffic more effectively through the modelling of network traffic and to visualise these interactions through a novel network forensic analysis tool.
Source: Scopus