Study of Network Foren sics and its Applica tion Techn iques

27 3 2006 3 M IN I- M ICRO SYST EM S V o l127 N o 3 M aṙ 2006 1 2 1 1 1 1 1 ( 210016) 2 ( 223001) E2m ail: z yd@ 163 com : ID S A gent SVM : ; ; ; ; SVM : T P393 : A : 100021220 (2006) 0320558205 Study of Network Foren sics and its Applica tion Techn iques ZHAN G You2dong 1 2 WAN G J ian2dong 1 YE Fei2yue 1 CH EN H ui2p ing 1 L I T ao 1 1 (N anj ing U niversity of A eronau tics and A stronau tics D ep artm ent of Comp u ter S cience and E ng ineering N anj ing 210016 Ch ina) 2 (H uaiy in Institu te of T echnology D ep artm ent of Comp u ter E ng ineering H uaian 223001 Ch ina) Abstract: A t p resent the research of netw o rk fo rensics is far from m ature and the use of nom enclature is very confused paper discusses the analysis techniques in netw o rk fo rensics and netw o rk fo rensic m ethods based on ID S honeytrap A gent fuzzy ES and SVM netw o rk monito r and so on m ent trend of the netw o rk fo rensicṡ It is p ropo sed how to design the netw o rk fo rensic system s based on the techniques of intrusion to lerance To sum up w e discuss system atically the concep ts m ethods realizing techniques and the develop2 Key words: netw o rk fo rensics; intrusion detection; intrusion to lerance; expert system; SVM 1 (D igital Fo rensics) ( E lectric Fo rensics ) ( Computer Fo rensic) (N etw o rk s Fo rensics) Internet 90 M arcus R anum [2 ] D FR2 2 W S 2001 1969 (Computer2D erived Evidence) [1 ] 30 2004 9 11 ( Intrusion Fo rensics) T he : 2004212201 : (G1999032701) : 1967 ; 1945

3 : 559 3 ID S (encoding) (Encryp tion) (chain of custody ") (Fo rensic Computing) [3 ] 4 4 (E lectric Evidence) ID S SVM : ; ( ); ( ID S 5 ) 1 ID S 1 [10 ] tcpdump [ 11 ] tcpdump V icka [12 ] [4 Co rey tcpdump ] 5 2 E thereal N etd ecto r N et Intercep t (Honeytrap ) (Honeypo t) (Hon2 (Session iz2 ing) 1 [4 ] 5 ( ID S) ID S 1999 Yuill [5 ] 2000 Stephenson ( Intrusion M anagem entm odel) [6 ] Gro ss [7 ] M onroe [8 ] Somm er [9 ] eynet)? A lec Yasinsac and Yanet M anzano

560 2006 [13 ] 5 5 (Senso r) [14 ] [ 15 ] ( the Federation of D ecoy N etw o rk) 5 6 5 3 (N etw o rk Tomography) [24 ] ID S CT (P robe Packet) [23 ] DDoS [23 ] 5 7 Agen t A gent [ 22 ] 5 4 A gent ID S ID S A gent : ( Intrusion To lerant System ) [16 ] 5 8 SVM g ID S M ukkam ala H Sung [17 SVM ] ANN SVM ANN SVM 6 FESNF FESN F Jun2Sun K im [18 ] FESN F 2 :

3 : 561 ( ) : i Si Si (T im e Α P ro toco l p ) Α p p Α 2 : : IF X 1= A 1 and X 2= A 2 and X n= A n TH EN Y= Z X i Y A i Z IF TH EN FESN F 5 TCP po rt SCAN TCP SYN F looding ICM P sm urf L and P ing O f D eath ( Z1 Z5 ) : References: [ 1 ] Edw ard W ilding Sw eet & M axw ell Computer evidence: a fo rensic investigations handbook [ Z ] Computer F raud & Secu2 : rity January 1997 E lsevier L td [ 2 ] M arcus Ranum N etwo rk fligh t reco rder [ EBgOL ] h ttp: gg www ranum com : 2 digital investigations p rocess [ Z ] D FRW S Baltimo re M ary2 land A ugust 2004 : [ 4 ] V icka Co rey et al N etwo rk fo rensics analysis[c ] IEEE Inter2 net Computing N ovem ber D ecem ber 2002 0 9 0 1 [ 5 ] J im Yuill S Felix W u Fenm in Gong et al Intrusion detection Si fo r an on2go ing attack [C ] 2nd International W o rk shop on Re2 cent A dvances in Intrusion D etection2ra ID 99 [ 6 ] Peter Stephenson Intrusion m anagem ent: a top level model fo r 7 securing info rm ation assets in an enterp rise environm ent [ C ] P roceedings of E ICA R 2000 B russels Belgium M arch 2000 [ 7 ] A ndrew H Gro ss A nalyzing computer intrusions[d ] PhD T he2 sis U niversity of Califo rnia San D iego San D iego CA 1997 (5) [25 ] 8 [ 3 ] Beebe C lark A h ierarch ical objectives2based fram ewo rk fo r the [ 8 ] BalckL ab: a wo rkbench fo r fo rensic analysts[z ] A rea System s (1) Exodus Comm unications Inc Co lum bia M D D ecem ber 1999 [ 9 ] Peter Somm eṙ Intrusion detection system as evidence[ Z ] Re2 cent A dvances in Intrusion D etection2ra ID 98 (2) [ 10 ] Peter Stephenson The app lication of intrusion detection sys2 tem s in a fo rensic environm ent [C ] P roceedings of the RA ID 2000 Conference Toulouse F rance 2000 (3) [ 11 ] A ndrew Honing et al A dap tive model generation: an architec2 [19 ] ture fo r dep loy of data m ining based intrusion D etection System s [20 ] [ EBgOL ] http: ggciteseer isṫ p su edug [21 (4) ] [ 12 ] U do Payer Realtim e intrusion2fo rensics a first p ro to type im 2

562 2006 p lem entation [C ] TERENA N etwo rking Conrerence 2004 [ 13 ] A lec Yasinsac Yanet M anzano Po licies to enhance computer and netwo rk fo rensics[c ] 2 nd A nnual IEEE System M an Cy2 bernetic Info rm ation A ssurance W o rkshop June 2001 [ 14 ] A lec Yasinsac Yanet M anzano Honeytrap s a netwo rk fo ren2 sic too l[c ] Sixth M ulti2conference on System ics Cybernetics and Info rm atics O rlando F lo rida U SA July 14 218 2002 [ 15 ] Barbara Jones Redmon M aintaining fo rensic evidence fo r law enfo rcem ent agencies fo rm a federation of decoy netwo rks (CC IPS) [ EBgOL ] http: ggwww cybercrim e govgsearching h tm l [ 16 ] M CN C and D U niversity Sitar: a scalable intrusion to lerant ar2 chitecture fo r distributed services [ R ] Technical Repo rṫ Re2 search P ropo sal to DA RPA BAA 200215 2000 [ 17 ] Srinivas M ukkam ala A ndrew H Sung Identifying significant features fo r netwo rk fo rensic analysis using artificial intelligent techniques[j ] International Journal of D igital Evidence W in2 ter 2003 1 (4) : 1217 [ 18 ] Jun2Sun Kim M insoo Kim Bong2N am N o th A fuzzy expert system fo r netwo rk fo rensics[c ] The 2004 International Con2 ference on Computational Science and Its A pp lications ( ICCSA 2004) Perugia Italy (LN CS) M ay 2004 [ 19 ] M arcus K Rogers Kata Seigfried The future of computer fo rensic: a needs analysis survey [ J ] Computer & Security 2004 23 12216 [ 20 ] M arcelo Paulo Standardization of computer fo rensic p ro toco ls and p rocedures[c ] 14 th A nnual F IRST Computer Security Con2 ference June 26 2002 [ 21 ] F rank Stajano 2002 Security fo r ubiquitous computing [M ] W iley 2002 [22 ] Ren W ei J in H ai A fram ewo rk of distributed agent2based ac2 tive and real tim e netwo rk fo rensics system [Z ] D FRW S 2004 [ 23 ] H e Ye2p ing A pp lication of m alicions code in computer fo rensics [ C ] The F irst N ational W o rkshop on Computer Fo rensics Beijing 2004 11 [ 24 ] X ia Yang Zhu W ei2p ing Research and developm ent of netwo rk tom graphy [J ] Computer Engineering and A pp lication 2004 40 (13) 1332137 [ 25 ] W ang L ing Q ian H ua2lin Computer fo rensics and its future trend[j ] Journal of Softw are 2003 14 (9) : 163521644 : [ 23 ] [C ] 2004 11 [ 24 ] [J ] 2004 40 (13) : 1332137 [ 25 ] [J ] 2003 14 (9) : 163521644