An evidential network forensics analysis model with adversarial capability and layering

Amran, Ahmad Roshidi; Saad, Amna

doi:10.1109/wccais.2014.6916615

Cited by 3 publications

(1 citation statement)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(Sikos, 2020) This paper is a comprehensive survey of the utilization of packet analysis, including deep packet inspection, in network forensics, and provides a review of AIpowered packet analysis methods with advanced network classification and pattern identification capabilities. (Amran & Saad, 2014) This paper proposes a model for network forensics analysis that captures appropriately defined adversarial capability and structured by a layered approach to investigation. (Qureshi et al, 2021) This paper provides a comprehensive analysis of the concept of network forensic investigation and describing the methodologies and tools employed in network forensic investigations by emphasizing on the study and analysis of the OSCAR methodology.…”

Section: Related Literaturementioning

confidence: 99%

Effective ways of Carrying Out Network Autopsy

Gyamfi¹

2022

AIMS Research Publication

View full text Add to dashboard Cite

By focusing on intrinsic network weaknesses and communication processes, network forensics techniques aid in the tracking of internal and external network attacks. However, when cyber criminals remove traces in order to evade detection, the investigation of cybercrime becomes more difficult. As a result, network forensics approaches use mechanisms to make inquiry easier by recording every packet and event that passes over the network. As a result, it is possible to determine the source of the assault by reconstructing the captured data. The purpose of this paper is to outline effectives way of carrying out network autopsy. Keywords: Network Autopsy, Network Forensics, Network Security, Packets, Data Capture. BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free Citation: Louis Opoku Gyamfi (2022): Effective ways of Carrying Out Network Autopsy Book Chapter Series on Research Nexus in IT, Law, Cyber Security & Forensics. Pp 329-334 www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P52

show abstract

Section: Related Literaturementioning

confidence: 99%

Effective ways of Carrying Out Network Autopsy

Gyamfi¹

2022

AIMS Research Publication

View full text Add to dashboard Cite

show abstract

Digital Forensics Subdomains: The State of the Art and Future Directions

et al. 2021

View full text Add to dashboard Cite

For reliable and relevant scientific evidence to be admitted in a court of law, it is important to apply digital forensic investigation techniques to corroborate a suspected potential security incident. Mainly, traditional digital forensics techniques have focused on computer desktops and servers. However, recent advances in digital media and platforms have seen an increased need for the application of digital forensic investigation techniques to other subdomains including small and mobile devices, databases, networks, cloudbased platforms, and the Internet of Things (IoT). To assist forensic investigators, conduct investigations within these subdomains, academic researchers have attempted to develop a number of investigative processes. However, many of these processes are domain-specific or describe domain-specific investigative tools. Hence, we hypothesize that the literature is littered with potentially overlapping and contradicting investigative process for conducting investigations within these subdomains. To investigate this hypothesis, a digital forensic model-orientated Systematic Literature Review (SLR) within the above digital forensic subdomains was undertaken. The purpose of the SLR was to identify the different and heterogeneous practices that have emerged within the specific subdomains. A key finding from the SLR is that there is a potential information overload and a high-degree of ambiguity among investigative processes in the above subdomains. The outcome of this study proposes a high-level abstract metamodel called The Digital Forensic Metamodel (DFM), which combines common processes, activities, techniques, and tasks for the above subdomains.

show abstract

A Detection and Investigation Model for the Capture and Analysis of Network Crimes

Alansari

2023

Eng. Technol. Appl. Sci. Res.

View full text Add to dashboard Cite

Investigation in the field of network forensics involves examining network traffic to identify, capture, preserve, reconstruct, analyze, and document network crimes. Although there are different perspectives on the practical and technical aspects of network forensics, there is still a lack of fundamental guidelines. This paper proposes a new detection and investigation model for capturing and analyzing network crimes, using design science research. The proposed model involves six processes: identification, verification, gathering, preservation, examination, analysis, and documentation. Each process is associated with several activities that provide the investigation team with a clear picture of exactly what needs to be performed. In addition, the proposed model has a unique activity, namely reporting. As a result, this model represents a comprehensive approach to network forensics investigations. It is designed to work in conjunction with established forensic techniques to ensure that forensic evidence from the network is collected and analyzed efficiently and effectively following accepted forensic procedures. The proposed model was compared with existing models in terms of completeness, showing that it is complete and can be adapted to any type of network and legal framework.

show abstract

An evidential network forensics analysis model with adversarial capability and layering

Cited by 3 publications

References 18 publications

Effective ways of Carrying Out Network Autopsy

Effective ways of Carrying Out Network Autopsy

Digital Forensics Subdomains: The State of the Art and Future Directions

A Detection and Investigation Model for the Capture and Analysis of Network Crimes

Contact Info

Product

Resources

About