Abstract
Network forensics known as an extended phase of network security plays an essential role in dealing with cybercrime. The performance of a network forensics system heavily depends on the network attack detection solutions. Two main types of network attacks are network level and application level. Current research methods have improved the detection rate but this is still a challenge. We propose a Shannon entropy approach to this study to identify executable file content for anomaly-based network attack detection in network forensics systems. Experimental results show that the proposed approach provides high detection rate.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Perdisci, R., Ariu, D., Fogla, P., Giacinto, G., Lee, W.: McPAD: A multiple classifier system for accurate payload-based anomaly detection. Computer Networks 53, 864–881 (2009)
Pilli, E.S., Joshi, R.C., Niyogi, R.: Network forensic frameworks: Survey and research challenges. Digital Investigation 7, 14–27 (2010)
Like, Z., White, G.B.: An Approach to Detect Executable Content for Anomaly Based Network Intrusion Detection. In: IEEE International Parallel and Distributed Processing Symposium, IPDPS 2007, pp. 1–8 (2007)
Christodorescu, M., Jha, S.: Static analysis of executables to detect malicious patterns. DTIC Document (2006)
Shannon, C.E., Weaver, W.: The mathematical theory of communication, vol. 19, p. 1. University of Illinois Press, Urbana (1949)
Chang, C.-C., Lin, C.-J.: LIBSVM: a library for support vector machines. ACM Transactions on Intelligent Systems and Technology (TIST) 2, 27 (2011)
Karresand, M., Shahmehri, N.: File Type Identification of Data Fragments by Their Binary Structure. In: 2006 IEEE Information Assurance Workshop, pp. 140–147 (2006)
Sportiello, L., Zanero, S.: File Block Classification by Support Vector Machine. In: 2011 Sixth Int. Conf. on Availability, Reliability and Security (ARES), pp. 307–312 (2011)
Veenman, C.J.: Statistical Disk Cluster Classification for File Carving. In: Third Int. Symposium on Information Assurance and Security, IAS 2007, pp. 393–398 (2007)
Pietrek, M.: Inside Windows-An In-Depth Look into the Win32 Portable Executable File Format, Part 2. MSDN magazine, 87–100 (2002)
Yasinsac, A., Manzano, Y.: Policies to enhance computer and network forensics. In: Proc. of the IEEE Workshop on Information Assurance and Security, pp. 289–295 (2001)
McDaniel, M., Heydari, M.H.: Content based file type detection algorithms. In: Proc. of the 36th Annual Hawaii International Conference on System Sciences, p. 10 (2003)
Fitzgerald, S., Mathews, G., Morris, C., Zhulyn, O.: Using NLP techniques for file fragment classification. Digital Investigation 9(suppl.), S44–S49 (2012)
Axelsson, S.: The Normalised Compression Distance as a file fragment classifier. Digital Investigation 7(suppl.), S24–S31 (2010)
Wei-Jen, L., Ke, W., Stolfo, S.J., Herzog, B.: Fileprints: identifying file types by n-gram analysis. In: Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop, IAW 2005, pp. 64–71 (2005)
Shannon, M.: Forensic relative strength scoring: ASCII and entropy scoring. International Journal of Digital Evidence 2, 151–169 (2004)
Hall, G.A.: Sliding window measurement for file type identification (2006)
Amirani, M.C., Toorani, M., Mihandoost, S.: Feature-based Type Identification of File Fragments. Security and Communication Networks 6, 115–128 (2013)
Roussev, V., Garfinkel, S.L.: File Fragment Classification-The Case for Specialized Approaches. In: Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering, SADFE 2009, pp. 3–14 (2009)
Roussev, V., Quates, C.: File fragment encoding classification—An empirical approach. Digital Investigation 10(suppl.), S69–S77 (2013)
Garfinkel, S., Farrell, P., Roussev, V., Dinolt, G.: Bringing science to digital forensics with standardized forensic corpora. Digital Investigation 6, S2–S11 (2009)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2014 Springer International Publishing Switzerland
About this paper
Cite this paper
Nguyen, K., Tran, D., Ma, W., Sharma, D. (2014). A New Approach to Executable File Fragment Detection in Network Forensics. In: Au, M.H., Carminati, B., Kuo, CC.J. (eds) Network and System Security. NSS 2015. Lecture Notes in Computer Science, vol 8792. Springer, Cham. https://doi.org/10.1007/978-3-319-11698-3_40
Download citation
DOI: https://doi.org/10.1007/978-3-319-11698-3_40
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-11697-6
Online ISBN: 978-3-319-11698-3
eBook Packages: Computer ScienceComputer Science (R0)