Abstract
Network Forensics is an important extension to the model of network security where emphasis is traditionally put on prevention and to a lesser extent on detection. It focuses on the capture, recording, and analysis of network packets and events for investigative purposes. It is a young field for which very limited resources are available. In this paper, we briefly survey the state of the art in network forensics and report our experience with building and testing a network forensics system.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Richardson, R.: 2003 csi/fbi computer crime and security survey (2003)
Ranum, M.: Network forensics: Network traffic monitoring. NFR Inc. (1997)
Ranum, M., et al.: Implementing a generalized tool for network monitoring. In: Proceedings of the Eleventh Systems Administration Conference (LISA 1997) (1997)
searchSecurity.com: Definitions, http://www.searchsecurity.techtarget.com
Sommer, P.: Intrusion detection systems as evidence. Computer Net. 31 (1999)
Brezinski, D., Killalea, T.: Guidelines for evidence collection and archiving. BCP 55, RFC 3227 (2002)
Fennelly, C.: Analysis: The forensics of internet security. SunWorld (2000)
Berghel, H.: The discipline of internet forensics. Comm. of the ACM (2003)
King, N., Weiss, E.: Analyze this! Information Security Magazine (2002)
Balas, E.: Know Your Enemy: Sebek. Honeynet Project (2003)
Spitzner, L.: Honeynetproject, http://www.honeynet.org
Roesch, M., Green, C.: Snort Users Manual (2003)
MySQL, http://www.mysql.com
Danyliw, R.: Analysis console for intrusion databases, acidlab.sourceforge.net
tcpdump/libpcap, http://www.tcpdump.org
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Almulhem, A., Traore, I. (2005). Experience with Engineering a Network Forensics System. In: Kim, C. (eds) Information Networking. Convergence in Broadband and Mobile Networking. ICOIN 2005. Lecture Notes in Computer Science, vol 3391. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-30582-8_7
Download citation
DOI: https://doi.org/10.1007/978-3-540-30582-8_7
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-24467-7
Online ISBN: 978-3-540-30582-8
eBook Packages: Computer ScienceComputer Science (R0)