Network Forensic Analysis by Correlation of Attacks with Network Attributes

Abstract

Network forensics involves the capture, recording, and analysis of network events in order to discover the source of security attacks and other problem incidents. We extend our previously proposed model for collecting network data, identifying suspicious packets, examining protocol features misused and correlating attack attributes. This model is capable of handling attacks on the TCP/IP suite. The results obtained by this model are validated. © Springer-Verlag Berlin Heidelberg 2010.