Extended Generic Process Model for Analysis MITM Attack Based on Evil Twin

Abstract

The high of criminal level related to the field of networking, is a threat that is quite dangerous MITM. The perpetrators of this attack use a fake AP (access point) with different gateway settings that are legitimate AP, so this type of attack becomes quite difficult to detect. This is due to the lack of standard operating procedures (SOP) in handling this case. This research was conducted with the aim of making a forensic model based on the analysis stages in the Evil Twin based MITM case using the user side based live forensic method. The results of the forensic investigation in the study resulted in an investigative model of ENFGP (Extended NFGP) which was divided into 10 stages and consisted of 30 completion steps, obtained through the process of testing and implementation methods in the MITM based Evil Twin attack and further testing based on several previous forensic models.