Network Forensic System for ICMP Attacks

Abstract

Network forensics is capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents. This paper addresses the major challenges in collection, examination and analysis processes. We propose a model for collecting network data, identifying suspicious packets, examining protocol features misused and validating the attack. This model has been built with specific reference to security attacks on ICMP protocol. The packet capture file is analyzed for significant ICMP protocol features to mark suspicious packets. The header information encapsulated in the packet capture file is ported to a database. Rule sets designed for various ICMP attacks are queried on the database to calculate various statistical thresholds. This information validates the presence of attacks and will be very useful for the investigation phase. The reduced packet capture size is easy to manage as only marked packets are considered. The protocol features usually manipulated by the attackers is available in database format for next stage analysis and investigation. The model has been tested with a sample attack dataset and the results are satisfactory. The model can be extended to include attacks on other protocols.

Guidelines for procedures of a harmonised digital forensic process in network forensics

“…Such packets are marked as suspicious and are kept separate. This helps in reducing the amount of data that needs to be analysed, as the main focus will be on the marked packets [10]. This action needs to occur in parallel with the protocol decoding and packet extraction actions.…”

“…Based on the marked packets, the evidence can be classified in order of relevancy. Evidence with most suspicious packets will be prioritised in the analysis phase and so reduce the data to be analysed [10]. It should be noted that analysis of the prioritised evidence may eventually lead to a need to analyse evidence that has not been prioritised.…”

“…If the evidence has been transported through physical storage media, it has to be stored according to how it is presented in [10]. If evidence is stored online, the environment needs to be secure with highly restricted remote access.…”

“…There are efforts by other researchers [8][9][10] aimed at standardising network forensic procedures but they leave a lot to be desired. In the next section we present a harmonised digital forensic process on which the procedures proposed in this paper are based.…”

“…This action involves extraction of IP and ICMP attributes from IP packets [10] and their storing in a database. The attributes may be helpful in the analysis phases for easier identification of IP addresses that were involved in a communication.…”