Conference paper

PLUSKAL Jan, RYŠAVÝ Ondřej and VESELÝ Vladimír. NetFox - The network forensic extandable analysis tool. In: 6th AFCEA Student Conference Future of Information and Communication Technology. Bucharest: University Politehnica of Bucharest, 2014, pp. 68-71. ISBN 978-606-551-047-0.
Publication language:english
Original title:NetFox - The network forensic extandable analysis tool
Title (cs):NetFox - Síťový, forézní rozšiřitelný analyzační nástroj
Pages:68-71
Proceedings:6th AFCEA Student Conference Future of Information and Communication Technology
Conference:6th AFCEA Europe Student Conference
Place:Bucharest, RO
Year:2014
ISBN:978-606-551-047-0
Publisher:University Politehnica of Bucharest
Keywords
Network forensic framework, data-mining, pcap
manipulation, forensic network data analysis
Annotation
The Network forensic analysis is increasingly discussed topic in the recent decade because of a rapidly raising number of criminal activities employing a network infrastructure. As computer networks grow and a new equipment is being connected every second, a crucial need for an efficient network monitoring tool arises. Two basic methods are applied. Firstly, collecting traffic metadata in a form of Netflow records, which are often applied in solutions of data retention, to provide an evidence of intercommunication of network devices. Secondly, full communication capturing followed by the subsequent detailed analysis is applied in specific cases, when a target of an investigation is known.

We present a network forensic platform, called Netfox.Framework, which has been developed as an open-source, extensible, and modular analytical software framework, providing a conversation-based approach usable for an advanced data-mining in a captured communication. The NFX development is driven by the need of providing a robust method to reduce a complexity and a time during a development of various specific network forensic applications. Almost every possible forensic investigation use-case requires to reconstruct, at least partially, an application data layer. The functionality implemented in the NFX resembles not only the implementation of TCP/IP stack at end nodes, but also other mechanisms necessary to understand bidirectional communication up to application protocol layers.
BibTeX:
@INPROCEEDINGS{
   author = {Jan Pluskal and Ond{\v{r}}ej Ry{\v{s}}av{\'{y}} and
	Vladim{\'{i}}r Vesel{\'{y}}},
   title = {NetFox - The network forensic extandable analysis tool},
   pages = {68--71},
   booktitle = {6th AFCEA Student Conference Future of Information and
	Communication Technology},
   year = {2014},
   location = {Bucharest, RO},
   publisher = {University Politehnica of Bucharest},
   ISBN = {978-606-551-047-0},
   language = {english},
   url = {http://www.fit.vutbr.cz/research/view_pub.php.en.iso-8859-2?id=10693}
}

Your IPv4 address: 54.166.232.243
Switch to IPv6 connection

DNSSEC [dnssec]