F-IDS: A Technique for Simplifying Evidence Collection in Network Forensics
نویسندگان
چکیده
The increasing numbers of cybercrimes nowadays make network forensic a very important area to be studied. In network forensic analysis, evidence is the crucial elements in the investigation process. However, gathering evidences from network is quite difficult because of the large amount of data in the network system. In addition, getting filtered data for analysis purpose is still a major issue for forensic professional. To contribute in solving the problems, we propose Forensic‐based Intrusion Detection System (F‐IDS), a new framework to simplify evidences gathering from network by utilizing mechanisms available on the structure of general IDS, the IDS structure will be examined and then enhanced so that the network packet collected by the IDS will be channeled and stored for forensic analysis purpose, also a proper mechanism to identify prospective evidences from the traffic will be proposed. From the conducted system simulation and several testing, the system is able to recognize the expected evidences which are injected as test input based on the classification mechanism.
منابع مشابه
Developing New Approaches for Intrusion Detection in Converged Networks
An Intrusion Detection System (IDS) is an important evidence collection tool for network forensics analysis. An IDS operates by inspecting both inbound and outbound network activity and identifying suspicious patterns that may be indicative of a network attack. For each suspicious event, IDS software typically records information similar to statistics logged by firewalls and routers (e.g., date...
متن کاملDistributed Network Forensics Framework: A Systematic Review
Network forensics is a branch of digital forensics, which applies to network security. It is used to relate monitoring and analysis of the computer network traffic, that helps us in collecting information and digital evidence, for the protection of network that can use as firewall and IDS. Firewalls and IDS can't always prevent and find out the unauthorized access within a network. This pa...
متن کاملNetwork Intrusion Forensic Analysis Using Intrusion Detection System
The need for computer intrusion forensics arises from the alarming increase in the number of computer crimes that are committed annually. After a computer system has been breached and an intrusion has been detected, there is a need for a computer forensics investigation to follow. Computer forensics is used to bring to justice, those responsible for conducting attacks on computer systems throug...
متن کاملDesign and Research of Hybrid Network Electronic Forensics Model Based on Cloud Computing
With the increase of computer network crimes and the changes of the forms, the work of the network electronic forensics is becoming more and more important, and it is required that the technology of electronic forensics should be adapted to the development of complex network crimes. In this paper, the traditional electronic evidence collection technology and the electronic evidence collection m...
متن کاملEvaluation of an Intrusion Detection System for Routing Attacks in Wireless Self-organised Networks
Wireless Sensor Networks (WSNs) arebecoming increasingly popular, and very useful in militaryapplications and environmental monitoring. However,security is a major challenge for WSNs because they areusually setup in unprotected environments. Our goal in thisstudy is to simulate an Intrusion Detection System (IDS)that monitors the WSN and report intrusions accurately andeffectively. We have thus...
متن کامل