Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning
AbstractAs the Internet becomes larger in scale, more complex in structure and more diversified in traffic, the number of crimes that utilize computer technologies is also increasing at a phenomenal rate. To react to the increasing number of computer crimes, the field of computer and network forensics has emerged. The general purpose of network forensics is to find malicious users or activities by gathering and dissecting firm evidences about computer crimes, e.g., hacking. However, due to the large volume of Internet traffic, not all the traffic captured and analyzed is valuable for investigation or confirmation. After analyzing some existing network forensics methods to identify common shortcomings, we propose in this paper a new network forensics method that uses a combination of network vulnerability and network evidence graph. In our proposed method, we use vulnerability evidence and reasoning algorithm to reconstruct attack scenarios and then backtrack the network packets to find the original evidences. Our proposed method can reconstruct attack scenarios effectively and then identify multi-staged attacks through evidential reasoning. Results of experiments show that the evidence graph constructed using our method is more complete and credible while possessing the reasoning capability. View Full-Text
Share & Cite This Article
He, J.; Chang, C.; He, P.; Pathan, M.S. Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning. Future Internet 2016, 8, 54.
He J, Chang C, He P, Pathan MS. Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning. Future Internet. 2016; 8(4):54.Chicago/Turabian Style
He, Jingsha; Chang, Chengyue; He, Peng; Pathan, Muhammad S. 2016. "Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning." Future Internet 8, no. 4: 54.
Note that from the first issue of 2016, MDPI journals use article numbers instead of page numbers. See further details here.