A Novel Approach to Network Forensic Analysis: Combining Packet Capture Data and Social Network Analysis

Log data from computers used for network forensic analysis is ineffective at identifying specific security threats. limitations include the difficulty in reconstructing communication patterns between nodes and inability to identify more advanced By combining traditional log methods with a effective combination of approaches, comprehensive view can be achieved. This combined approach then help potential threats effectively. It's difficult determine benefits Packet Capture (PCAP) Social Network Analysis (SNA) when performing forensics. article proposes new that combines PCAP social overcome some methods. The purpose this discovery improve accuracy by provide patterns. forensics, which pcap analysis, provides results. analyze traffic, conversation statistics, protocol distribution, packet content round-trip times. maps identifies most influential key players within network. efficiently captures analyzes packets, SNA insight into relationships devices on