Publication detail

Advanced Techniques for Reconstruction of Incomplete Network Data

MATOUŠEK, P. PLUSKAL, J. RYŠAVÝ, O. VESELÝ, V. KMEŤ, M. KARPÍŠEK, F. VYMLÁTIL, M.

Original Title

Advanced Techniques for Reconstruction of Incomplete Network Data

Type

journal article in Web of Science

Language

English

Original Abstract

Network forensics is a method of obtaining and analysing digital evidences from network sources. Network forensics includes data acquisition, selection, processing, analysis and presentation to  investigators. Due to high volumes of transmitted data the  acquired information can be incomplete, corrupted, or disordered  which makes further reconstruction dicult. In this paper, we address the issue of advanced parsing and reconstruction of  incomplete, corrupted, or disordered data packets. We introduce a technique that recovers TCP or UDP conversations so they could be further analysed by application parsers. Presented  technique is implemented in a new network forensics tool called  NetFox.Detective. We also discuss current challenges in parsing  webmail communication, SSL decryption and Bitcoins detection.

Keywords

network forensics tools, TCP reassembling, traffic reconstruction, webmail, bitcoin, SSL encryption

Authors

MATOUŠEK, P.; PLUSKAL, J.; RYŠAVÝ, O.; VESELÝ, V.; KMEŤ, M.; KARPÍŠEK, F.; VYMLÁTIL, M.

RIV year

2015

Released

10. 10. 2015

ISBN

1867-8211

Periodical

Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering

Year of study

2015

Number

157

State

Kingdom of the Netherlands

Pages from

69

Pages to

84

Pages count

16

URL

http://link.springer.com/chapter/10.1007/978-3-319-25512-5_6

BibTex

@article{BUT119835,
  author="Petr {Matoušek} and Jan {Pluskal} and Ondřej {Ryšavý} and Vladimír {Veselý} and Martin {Kmeť} and Filip {Karpíšek} and Martin {Vymlátil}",
  title="Advanced Techniques for Reconstruction of Incomplete Network Data",
  journal="Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering",
  year="2015",
  volume="2015",
  number="157",
  pages="69--84",
  doi="10.1007/978-3-319-25512-5\{_}6",
  issn="1867-8211",
  url="http://link.springer.com/chapter/10.1007/978-3-319-25512-5_6"
}

Documents

ICDF2C2015.pdf