Result Details

Advanced Techniques for Reconstruction of Incomplete Network Data

MATOUŠEK, P.; PLUSKAL, J.; RYŠAVÝ, O.; VESELÝ, V.; KMEŤ, M.; KARPÍŠEK, F.; VYMLÁTIL, M. Advanced Techniques for Reconstruction of Incomplete Network Data. Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, 2015, vol. 2015, no. 157, p. 69-84. ISSN: 1867-8211.
Type
journal article
Language
English
Authors
Matoušek Petr, doc. Ing., Ph.D., M.A., DIFS (FIT)
Pluskal Jan, Ing., Ph.D., DIFS (FIT)
Ryšavý Ondřej, doc. Ing., Ph.D., DIFS (FIT)
Veselý Vladimír, Ing., Ph.D., FIT (FIT), DIFS (FIT)
Kmeť Martin, Ing., FIT (FIT), DIFS (FIT)
Karpíšek Filip, Ing., FIT (FIT)
Vymlátil Martin, Ing., FIT (FIT)
Abstract

Network forensics is a method of obtaining and analysing digital evidences from network sources. Network forensics includes data acquisition, selection, processing, analysis and presentation to  investigators. Due to high volumes of transmitted data the  acquired information can be incomplete, corrupted, or disordered  which makes further reconstruction dicult. In this paper, we address the issue of advanced parsing and reconstruction of  incomplete, corrupted, or disordered data packets. We introduce a technique that recovers TCP or UDP conversations so they could be further analysed by application parsers. Presented  technique is implemented in a new network forensics tool called  NetFox.Detective. We also discuss current challenges in parsing  webmail communication, SSL decryption and Bitcoins detection.

Keywords

network forensics tools, TCP reassembling, traffic reconstruction, webmail, bitcoin, SSL encryption

URL
Published
2015
Pages
69–84
Journal
Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, vol. 2015, no. 157, ISSN 1867-8211
DOI
10.1007/978-3-319-25512-5_6
UT WoS
000369892100006
EID Scopus
2-s2.0-84945921941
BibTeX 
@article{BUT119835,
  author="Petr {Matoušek} and Jan {Pluskal} and Ondřej {Ryšavý} and Vladimír {Veselý} and Martin {Kmeť} and Filip {Karpíšek} and Martin {Vymlátil}",
  title="Advanced Techniques for Reconstruction of Incomplete Network Data",
  journal="Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering",
  year="2015",
  volume="2015",
  number="157",
  pages="69--84",
  doi="10.1007/978-3-319-25512-5\{_}6",
  issn="1867-8211",
  url="http://link.springer.com/chapter/10.1007/978-3-319-25512-5_6"
}
Files
Projects
Modern Tools for Detection and Mitigation of Cyber Criminality on the New Generation Internet, MV, Program bezpečnostního výzkumu České republiky 2010 - 2015, VG20102015022, start: 2010-10-01, end: 2015-09-30, completed
Výzkum pokročilých metod ICT a jejich aplikace, BUT, Vnitřní projekty VUT, FIT-S-14-2299, start: 2014-01-01, end: 2016-12-31, completed
Research groups
NES@FIT - Networks and distributed systems research group (RG NES@FIT)
Departments
Department of Information Systems (DIFS)
Back to top