Network Forensics on Packet Fingerprints

Cho, Chia Yuan; Lee, Sin Yeung; Tan, Chung Pheng; Tan, Yong Tai

doi:10.1007/0-387-33406-8_34

Cited by 14 publications

(14 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We created our implementation of the HBF as an example of a current payload attribution method and include it in our comparisons in Section 5. The RBF's performance is comparable to that of the HBF and experimental results presented in [Cho et al 2006] show that RBF achieves low false positive rates only for small data reduction ratios (about 32:1).…”

Section: Attribution Systemsmentioning

confidence: 80%

“…The payload attribution methods presented in this section try to limit or completely eliminate (see Section 3.3) this negative effect. Alternative payload processing schemes, such as [Cho et al 2006;Gu et al 2007] perform partitioning of the payload at all possible starting offsets during the payload processing phase (which is basically similar to working on all n-grams of the payload) but it incurs a large overhead for processing speed and also storage requirements are multiplied.…”

Section: Methods For Payload Attributionmentioning

confidence: 99%

“…Recently, another group suggested an alternative approach to the payload attribution problem, the Rolling Bloom Filter (RBF) [Cho et al 2006], which uses packet content fingerprints based on a generalization of the Rabin-Karp stringmatching algorithm. Instead of aggregating queries in a hierarchy as an HBF, they aggregate query results linearly from multiple Bloom filters.…”

Section: Attribution Systemsmentioning

confidence: 99%

“…They introduced the idea of using Bloom filters to achieve a reduced size digest of the packet history that would support queries about whether any packet containing a certain payload excerpt has been seen; the reduction in data representation comes at the price of a manageable false positive rate in the query results. Subsequently a different group has offered a variant technique for the same problem [Cho et al 2006].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

New payload attribution methods for network forensic investigations

Ponec

Giura

Wein

et al. 2010

ACM Trans. Inf. Syst. Secur.

View full text Add to dashboard Cite

Payload attribution can be an important element in network forensics. Given a history of packet transmissions and an excerpt of a possible packet payload, a Payload Attribution System (PAS) makes it feasible to identify the sources, destinations and the times of appearance on a network of all the packets that contained the specified payload excerpt. A PAS, as one of the core components in a network forensics system, enables investigating cybercrimes on the Internet, by, for example, tracing the spread of worms and viruses, identifying who has received a phishing email in an enterprise, or discovering which insider allowed an unauthorized disclosure of sensitive information.Due to the increasing volume of network traffic in today's networks it is infeasible to effectively store and query all the actual packets for extended periods of time in order to allow analysis of network events for investigative purposes; therefore we focus on extremely compressed digests of the packet activity. We propose several new methods for payload attribution which utilize Rabin fingerprinting, shingling, and winnowing. Our best methods allow building practical payload attribution systems which provide data reduction ratios greater than 100:1 while supporting efficient queries with very low false positive rates. We demonstrate the properties of the proposed methods and specifically analyze their performance and practicality when used as modules of a network forensics system ForNet. Our experimental results outperform current state-of-the-art methods both in terms of false positives and data reduction ratio. Finally, these approaches directly allow the collected data to be stored and queried by an untrusted party without disclosing any payload information nor the contents of queries.

show abstract

Section: Attribution Systemsmentioning

confidence: 80%

Section: Methods For Payload Attributionmentioning

confidence: 99%

Section: Attribution Systemsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

New payload attribution methods for network forensic investigations

Ponec

Giura

Wein

et al. 2010

ACM Trans. Inf. Syst. Secur.

View full text Add to dashboard Cite

show abstract

“…They introduced the idea of using Bloom filters to achieve a reduced size digest of the packet history which would support queries about whether any packet containing a certain payload excerpt has been seen; the reduction in data representation comes at the price of a manageable false positive rate in the queries. Subsequently a different group has offered a variant technique for the same problem [7].…”

Section: Introductionmentioning

confidence: 99%

Highly efficient techniques for network forensics

Ponec¹,

Giura²,

Brönnimann³

et al. 2007

Proceedings of the 14th ACM Conference on Computer and Communications Security

View full text Add to dashboard Cite

Given a history of packet transmissions and an excerpt of a possible packet payload, the payload attribution problem requires the identification of sources, destinations and the times of appearance on a network of all the packets that contained such payload. A module to solve this problem has recently been proposed as the core component in a network forensics system. Network forensics provides useful tools for investigating cybercrimes on the Internet, by, for example, tracing the spread of worms and viruses, identifying who has received a phishing email in an enterprise, or discovering which insider allowed an unauthorized disclosure of sensitive information.In general it is infeasible to store and query the actual packets, therefore we focus on extremely compressed digests of the packet activity. We propose several new methods for payload attribution which utilize Rabin fingerprinting, shingling, and winnowing. Our best methods allow data reduction ratios greater than 100:1 while supporting queries with very low false positive rates, and provide efficient querying capabilities given reasonably small excerpts of a payload. Our results outperform current state-of-the-art methods both in terms of false positive rates and data reduction ratio. Finally, these approaches directly allow the collected data to be stored and queried by an untrusted party without disclosing any payload information nor the contents of queries.

show abstract

Winnowing Multihashing Structure with Wildcard Query

Wei

Chen

et al. 2014

Web Technologies and Applications

View full text Add to dashboard Cite

Network Forensics on Packet Fingerprints

Cited by 14 publications

References 8 publications

New payload attribution methods for network forensic investigations

New payload attribution methods for network forensic investigations

Highly efficient techniques for network forensics

Winnowing Multihashing Structure with Wildcard Query

Contact Info

Product

Resources

About