Advanced Techniques for Reconstruction of Incomplete Network Data

Matoušek, Petr; Pluskal, Jan; Ryšavý, Ondřej; Veselý, Vladimír; Kmeť, Martin; Karpíšek, Filip; Vymlátil, Martin

doi:10.1007/978-3-319-25512-5_6

Cited by 6 publications

(2 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Before the capture file could be used, additional post-processing steps from previous work [22] were applied to enhance data extraction. The final post-processing step used a round of experiments with the enhanced statistical protocol identification method.…”

Section: Data Collection and Preprocessingmentioning

confidence: 99%

See 1 more Smart Citation

Traffic Classification and Application Identification in Network Forensics

Pluskal¹,

Lichtner²,

Ryšavý³

2018

Advances in Digital Forensics XIV

Self Cite

View full text Add to dashboard Cite

Network traffic classification is an absolute necessity for network monitoring, security analyses and digital forensics. Without accurate traffic classification, the computational demands imposed by analyzing all the IP traffic flows are enormous. Classification can also reduce the number of flows that need to be examined and prioritized for analysis in forensic investigations. This chapter presents an automated feature elimination method based on a feature correlation matrix. Additionally, it proposes an enhanced statistical protocol identification method, which is compared against Bayesian network and random forests classification methods that offer high accuracy and acceptable performance. Each classification method is used with a subset of features that best suit the method. The methods are evaluated based on their ability to identify the application layer protocols and the applications themselves. Experiments demonstrate that the random forests classifier yields the most promising results whereas the proposed enhanced statistical protocol identification method provides an interesting trade-off between higher performance and slightly lower accuracy.

show abstract

Section: Data Collection and Preprocessingmentioning

confidence: 99%

“…Matousek et al [22] have shown that other network forensic solutions do not effectively address these issues. This implies that adopting the proposed additional steps would also be beneficial in the context of network traffic classification.…”

Section: Data Collection and Preprocessingmentioning

confidence: 99%