Abstract

Network forensics is capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents. This paper addresses the major challenges in collection, examination and analysis processes. We propose a model for collecting network data, identifying suspicious packets, examining protocol features misused and validating the attack. This model has been built with specific reference to security attacks on ICMP protocol. The packet capture file is analyzed for significant ICMP protocol features to mark suspicious packets. The header information encapsulated in the packet capture file is ported to a database. Rule sets designed for various ICMP attacks are queried on the database to calculate various statistical thresholds. This information validates the presence of attacks and will be very useful for the investigation phase. The reduced packet capture size is easy to manage as only marked packets are considered. The protocol features usually manipulated by the attackers is available in database format for next stage analysis and investigation. The model has been tested with a sample attack dataset and the results are satisfactory. The model can be extended to include attacks on other protocols.

References

• Yasinsac, A. and Manzano, Y. 2001. Policies to Enhance Computer and Network Forensics. In IEEE Workshop on Information Assurance and Security.
• Ren, W. and Jin, H. 2005. Modeling the network forensics behaviors. In Proceedings of the 1st International Conference on Security and Privacy for Emerging Areas in Communication Networks.
• K. Y. Lam, L. Hui and S. L. Chung, “A Data Reduction Method for Intrusion Detection”, Journal of Systems and Software, 1996.
• Shanmugasundaram, K. and Memon, N. 2006. Network Monitoring for Security and Forensics. In proceedings of 2nd International Conference on Information Systems Security.
• Jacobson, V., Leres, C. and McCanne, S. Pcap and Libpcap. Lawrence Berkeley National Laboratory, www.tcpdump.org
• Almulhem, A. and Traore, I. 2005. Experience with Engineering a Network Forensics System. In Proceedings of International Conference on Information Networking.
• Postel, J. Internet Control Message Protocol, RFC 792. http:// tools.ietf.org/html/rfc0792
• Comer, D.E. and Stevens, D.L. 1991. Internetworking with TCP/IP.
• SANS Institute Reading Room. ICMP attack illustrated. http://www.sans.org/reading_room/whitepapers/threats/icmp_attacks_illustrated_477?show=477.php&cat=threats
• Kenney, M. Ping of death. http://www.insecure.org/sploits/ping-o-death.html.
• Kumar, S. 2007. Smurf-based Distributed Denial of Service (DDoS) Attack Amplification in Internet. In Proceedings of International Conference on Internet Monitoring and Protection.
• Dracinschi, A. and Fdida, S. 2000. Congestion Avoidance for Unicast and Multicast Traffic. In Proceedings of 1st European Conference on Universal Multiservice Networks.
• Wireshark, “Libpcap File Format,” December, 2008. http://wiki.wireshark.org/Development/LibpcapFileFormat
• Degioanni, L., Risso, F. and Varenni, G. 2004. PCAP Next Generation File Format. http://www.winpcap.org/ ntar/draft/PCAP-DumpFileFormat.html
• S. Mukkamala and A. H. Sung, “Identifying Significant Features for Network Forensic Analysis Using Artificial Intelligent Techniques”, International Journal of Digital Evidence, 2003.
• S. Staniford, J. A. Hoagland, and J. M. McAlerney, “Practical automated detection of stealthy portscans”, Journal of Computer Security 10, 2002.
• Bailey, M., Cooke, E., Jahanian, F., Provos, N., Rosaen, K. and Watson, D. 2005. Data reduction for the scalable automated analysis of distributed darknet traffic. In Proceedings of USENIX/ACM Internet Measurement Conference.
• Maier, G., Sommer, R., Dreger, H., Feldmann, A., Paxson, V. and Schneider, F. 2008. Enriching network security analysis with time travel. In Proceedings of ACM SIGCOMM.
• A reference manual on Snort Users Manual 2.8.4, http://www.snort.org/assets/120/snort_manual.pdf
• Jacobson, V., et al. TCPDump - dump traffic on a network, http://www.tcpdump.org/tcpdump_man.html
• Rechard, S. and Warnicke. Wireshark’s Users Guide, http://www.wireshark.org/docs/wsug_html_chunked/
• Lyon, G., F. Nmap Reference Guide, http://nmap.org/book/man.html
• Sing - Send ICMP Nasty Garbage packets to network hosts, http://www.securitydistro.com/toolinfo/31/Sing-MAN-Page.php
• Traceroute - print the route packets take to network host, http://www.freebsd.org/cgi/man.cgi?query=traceroute