Detail publikačního výsledku

Netfox Detective: A novel open-source Network Forensics Analysis Tool

PLUSKAL, J.; BREITINGER, F.; RYŠAVÝ, O.

Originální název

Netfox Detective: A novel open-source Network Forensics Analysis Tool

Anglický název

Netfox Detective: A novel open-source Network Forensics Analysis Tool

Druh

Článek WoS

Originální abstrakt

Network forensics is a major sub-discipline of digital forensics which becomes more and more important in an age where
everything is connected. In order to cope with the amounts of data and other challenges within networks, practitioners require powerful
tools that support them. In this paper, we highlight a novel open-source network forensic tool named - Netfox Detective - that
outperforms existing tools such as Wireshark or NetworkMiner in certain areas. For instance, it provides a heuristically based engine
for traffic processing that can be easily extended. Using robust parsers (we are not solely relying on the RFC description but use
heuristics), our application tolerates malformed or missing conversation segments. Besides outlining the tools architecture and basic
processing concepts, we also explain how it can be extended. Lastly, a comparison with other similar tools is presented as well as a
real-world scenario is discussed.

Anglický abstrakt

Network forensics is a major sub-discipline of digital forensics which becomes more and more important in an age where
everything is connected. In order to cope with the amounts of data and other challenges within networks, practitioners require powerful
tools that support them. In this paper, we highlight a novel open-source network forensic tool named - Netfox Detective - that
outperforms existing tools such as Wireshark or NetworkMiner in certain areas. For instance, it provides a heuristically based engine
for traffic processing that can be easily extended. Using robust parsers (we are not solely relying on the RFC description but use
heuristics), our application tolerates malformed or missing conversation segments. Besides outlining the tools architecture and basic
processing concepts, we also explain how it can be extended. Lastly, a comparison with other similar tools is presented as well as a
real-world scenario is discussed.

Klíčová slova

Network forensics, Protocol analysis, Web forensics, Network forensic analysis tool, Lawful interception

Klíčová slova v angličtině

Network forensics, Protocol analysis, Web forensics, Network forensic analysis tool, Lawful interception

Autoři

PLUSKAL, J.; BREITINGER, F.; RYŠAVÝ, O.

Rok RIV

2021

Vydáno

01.12.2020

ISSN

2666-2825

Periodikum

Forensic Science International: Digital Investigation

Svazek

35

Číslo

301019

Stát

Spojené státy americké

Strany od

1

Strany do

13

Strany počet

13

URL

https://www.sciencedirect.com/science/article/pii/S2666281720300871

BibTex

@article{BUT169468,
  author="Jan {Pluskal} and Frank {Breitinger} and Ondřej {Ryšavý}",
  title="Netfox Detective: A novel open-source Network Forensics Analysis Tool",
  journal="Forensic Science International: Digital Investigation",
  year="2020",
  volume="35",
  number="301019",
  pages="1--13",
  doi="10.1016/j.fsidi.2020.301019",
  issn="2666-2825",
  url="https://www.sciencedirect.com/science/article/pii/S2666281720300871"
}

Dokumenty

Netfox_DI