Detail publikace

Advanced Techniques for Reconstruction of Incomplete Network Data

MATOUŠEK, P.; PLUSKAL, J.; RYŠAVÝ, O.; VESELÝ, V.; KMEŤ, M.; KARPÍŠEK, F.; VYMLÁTIL, M. Advanced Techniques for Reconstruction of Incomplete Network Data. Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, 2015, vol. 2015, no. 157, p. 69-84. ISSN: 1867-8211.
Název česky
Pokročilé techniky pro rekonstrukci neúplného síťového provozu
Typ
článek v časopise
Jazyk
anglicky
Autoři
Matoušek Petr, doc. Ing., Ph.D., M.A. (UIFS)
Pluskal Jan, Ing., Ph.D. (UIFS)
Ryšavý Ondřej, doc. Ing., Ph.D. (UIFS)
Veselý Vladimír, Ing., Ph.D. (UIFS)
Kmeť Martin, Ing.
Karpíšek Filip, Ing.
Vymlátil Martin, Ing.
URL
Klíčová slova

síťová forenzní analýza, nástroje, TCP reassembling, rekonstrukce provozu, webové maily, bitcoiny, šifrování SSL

Abstrakt

Network forensics is a method of obtaining and analysing digital evidences from network sources. Network forensics includes data acquisition, selection, processing, analysis and presentation to  investigators. Due to high volumes of transmitted data the  acquired information can be incomplete, corrupted, or disordered  which makes further reconstruction dicult. In this paper, we address the issue of advanced parsing and reconstruction of  incomplete, corrupted, or disordered data packets. We introduce a technique that recovers TCP or UDP conversations so they could be further analysed by application parsers. Presented  technique is implemented in a new network forensics tool called  NetFox.Detective. We also discuss current challenges in parsing  webmail communication, SSL decryption and Bitcoins detection. č

Rok
2015
Strany
69–84
Časopis
Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, roč. 2015, č. 157, ISSN 1867-8211
DOI
10.1007/978-3-319-25512-5_6
UT WoS
000369892100006
EID Scopus
2-s2.0-84945921941
BibTeX 
@article{BUT119835,
  author="Petr {Matoušek} and Jan {Pluskal} and Ondřej {Ryšavý} and Vladimír {Veselý} and Martin {Kmeť} and Filip {Karpíšek} and Martin {Vymlátil}",
  title="Advanced Techniques for Reconstruction of Incomplete Network Data",
  journal="Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering",
  year="2015",
  volume="2015",
  number="157",
  pages="69--84",
  doi="10.1007/978-3-319-25512-5\{_}6",
  issn="1867-8211",
  url="http://link.springer.com/chapter/10.1007/978-3-319-25512-5_6"
}
Nahoru