Collecting Network Evidence Using Constrained Approximate Search Algorithms - Advances in Digital Forensics XIV Access content directly
Conference Papers Year : 2018

Collecting Network Evidence Using Constrained Approximate Search Algorithms

Abstract

Intrusion detection systems are defensive tools that identify malicious activities in networks and hosts. In network forensics, investigators often study logs that store alerts generated by intrusion detection systems. This research focuses on Snort, a widely-used, open-source, misuse-based intrusion detection system that detects network intrusions based on a pre-defined set of attack signatures. When a security breach occurs, a forensic investigator typically starts by examining network log files. However, Snort cannot detect unknown attacks (i.e., zero-day attacks) even when they are similar to known attacks; as a result, an investigator may lose evidence in a criminal case.This chapter demonstrates the ease with which it is possible to defeat the detection of malicious activity by Snort and the possibility of using constrained approximate search algorithms instead of the default Snort search algorithm to collect evidence. Experimental results of the performance of constrained approximate search algorithms demonstrate that they are capable of detecting previously unknown attack attempts that are similar to known attacks. While the algorithms generate additional false positives, the number of false positives can be reduced by the careful choice of constraint values in the algorithms.
Fichier principal
Vignette du fichier
472401_1_En_9_Chapter.pdf (342.1 Ko) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-01988834 , version 1 (22-01-2019)

Licence

Identifiers

Cite

Ambika Shrestha Chitrakar, Slobodan Petrovic. Collecting Network Evidence Using Constrained Approximate Search Algorithms. 14th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2018, New Delhi, India. pp.141-160, ⟨10.1007/978-3-319-99277-8_9⟩. ⟨hal-01988834⟩
64 View
58 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More