No abstract

No abstract

No abstract

DNS tunneling techniques are often used for malicious purposes. Network security mechanisms have struggled to detect DNS tunneling. Network forensic analysis has been proposed as a solution, but it is slow, invasive and tedious as network forensic analysis tools struggle to deal with undocumented and new network tunneling techniques.This chapter presents a method for supporting forensic analysis by automating the inference of tunneled protocols. The internal packet structure of DNS tunneling techniques is analyzed and the information entropy of various network protocols and their DNS tunneled equivalents are characterized. This provides the basis for a protocol prediction method that uses entropy distribution averaging. Experiments demonstrate that the method has a prediction accuracy of 75%. The method also preserves privacy because it only computes the information entropy and does not parse the actual tunneled content.

While cybercrime proliferates-becoming more complex and surreptitious-the tools and techniques used in performing digital investigations are still seriously lagging behind, effectively slowing down law enforcement agencies at large. In this paper we briefly describe the architecture of a comprehensive proactive digital investigation system that is termed as the Live Evidence Information Aggregator (LEIA). Particular focus is made on the importance of the efficiency of network communication in such a system in order to retrieve potentially evidentiary information remotely and with immediacy. We demonstrate the live evidence capturing capabilities of such a system highlighting the necessity for better throughput through the use of Peer-to-Peer Systems.