Detail publikačního výsledku

Advanced Techniques for Reconstruction of Incomplete Network Data

MATOUŠEK, P.; PLUSKAL, J.; RYŠAVÝ, O.; VESELÝ, V.; KMEŤ, M.; KARPÍŠEK, F.; VYMLÁTIL, M.

Originální název

Advanced Techniques for Reconstruction of Incomplete Network Data

Anglický název

Advanced Techniques for Reconstruction of Incomplete Network Data

Druh

Článek WoS

Originální abstrakt

Network forensics is a method of obtaining and analysing digital evidences from network sources. Network forensics includes data acquisition, selection, processing, analysis and presentation to  investigators. Due to high volumes of transmitted data the  acquired information can be incomplete, corrupted, or disordered  which makes further reconstruction dicult. In this paper, we address the issue of advanced parsing and reconstruction of  incomplete, corrupted, or disordered data packets. We introduce a technique that recovers TCP or UDP conversations so they could be further analysed by application parsers. Presented  technique is implemented in a new network forensics tool called  NetFox.Detective. We also discuss current challenges in parsing  webmail communication, SSL decryption and Bitcoins detection.

Anglický abstrakt

Network forensics is a method of obtaining and analysing digital evidences from network sources. Network forensics includes data acquisition, selection, processing, analysis and presentation to  investigators. Due to high volumes of transmitted data the  acquired information can be incomplete, corrupted, or disordered  which makes further reconstruction dicult. In this paper, we address the issue of advanced parsing and reconstruction of  incomplete, corrupted, or disordered data packets. We introduce a technique that recovers TCP or UDP conversations so they could be further analysed by application parsers. Presented  technique is implemented in a new network forensics tool called  NetFox.Detective. We also discuss current challenges in parsing  webmail communication, SSL decryption and Bitcoins detection.

Klíčová slova

network forensics tools, TCP reassembling, traffic reconstruction, webmail, bitcoin, SSL encryption

Klíčová slova v angličtině

network forensics tools, TCP reassembling, traffic reconstruction, webmail, bitcoin, SSL encryption

Autoři

MATOUŠEK, P.; PLUSKAL, J.; RYŠAVÝ, O.; VESELÝ, V.; KMEŤ, M.; KARPÍŠEK, F.; VYMLÁTIL, M.

Rok RIV

2016

Vydáno

10.10.2015

ISSN

1867-8211

Periodikum

Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering

Svazek

2015

Číslo

157

Stát

Nizozemsko

Strany od

69

Strany do

84

Strany počet

16

URL

http://link.springer.com/chapter/10.1007/978-3-319-25512-5_6

BibTex

@article{BUT119835,
  author="Petr {Matoušek} and Jan {Pluskal} and Ondřej {Ryšavý} and Vladimír {Veselý} and Martin {Kmeť} and Filip {Karpíšek} and Martin {Vymlátil}",
  title="Advanced Techniques for Reconstruction of Incomplete Network Data",
  journal="Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering",
  year="2015",
  volume="2015",
  number="157",
  pages="69--84",
  doi="10.1007/978-3-319-25512-5\{_}6",
  issn="1867-8211",
  url="http://link.springer.com/chapter/10.1007/978-3-319-25512-5_6"
}

Dokumenty

ICDF2C2015