Data reduction by identification and correlation of TCP/IP attack attributes for network forensics

Network forensics is an alternate approach to security, which monitors network traffic, stores the traces, detects anomalies, identifies the nature of attack, and investigates the source of attack. The challenge is to store, handle and analyze large volumes of network traffic. Attackers are exploiting the vulnerabilities in TCP/IP protocol suite and manipulating various attributes to launch attacks. In this paper, the attacks on TCP/IP protocol suite at the transport and network layer are studied and the significant network features being misused are identified. The key fields of the protocols are correlated with the attacks and are extracted from the packet capture files. These values are stored in a database and statistical information for determining various attack thresholds is derived. This information helps in identifying suspicious addresses and marking evidence packets for forensic analysis. These packets comprise of the highest probable evidence and are converted to a new packet capture file. The reduced size of this preprocessed data enables efficient storage, effective processing and time bound investigation.