Creating Learning Materials and Strategies for Network Forensics Education

计算机科学（31）该项目的目标包括（1）开发一个复杂而现实的教育基础设施，为本科生和研究生的网络取证课程提供有趣而现实的网络犯罪现场，以及（2）开发系统的实验室项目与创新的教育工具包，如无线定位机器人在三维空间中收集证据。为确保该项目的成功，采用了全面的形成性和总结性评价，该项目使用了现实的网络平台，并广泛覆盖了网络犯罪现场，如分布式匿名通信系统和无线网络。它利用PlanetLab，这是一个全球研究网络，提供覆盖服务并支持新网络服务的开发。提出者设计了一套用于在这种环境下教授网络取证的工具包，包括DeAncriminizer工具包，该工具包通过Ancriminizer和Tor等专业匿名通信网络对可疑网络流量添加水印来跟踪嫌疑人。另一个工具包3DLoc在三维空间中搜索可疑的移动终端。开发的网络取证项目和辅助材料在国家科学数字图书馆（NSDL）创建了一个知识库。PI为不同规模的学校提供详细的文件和免费咨询，并通过计算机教育和研究期刊、国际和国家会议以及门户网站等各种渠道传播该项目的成果。工业界和执法伙伴在技术转让过程中对硬件和援助进行标准化。

Computer Science (31) The objectives of this project include (1) developing a sophisticated and realistic educational infrastructure which provides interesting and realistic cyber-crime scenes for undergraduate and graduate network forensics curricula, and (2) developing systematic laboratory projects with innovative educational toolkits such as wireless positioning robots for collecting evidence in a 3-dimensional space. Comprehensive formative and summative evaluations are used to ensure the success of this project.The project uses realistic network platforms and provides a wide coverage of cyber-crime scenes such as distributed anonymous communication systems and wireless networks. It utilizes PlanetLab, a global research network that provides overlay services and supports the development of new network services. The proposer designed a set of toolkits for teaching network forensics in this environment, including DeAnonymizer toolkit which traces suspects by watermarking the suspect network traffic through professional anonymous communication networks such as Anonymizer and Tor. Another toolkit, 3DLoc, searches the suspect mobile device in a 3-dimensional space.The developed network forensics projects and supporting materials create a repository at the National Science Digital Library (NSDL). The PI provides detailed documents and free consulting for schools of different sizes and disseminates the outcomes of this project via various venues such as computer education and research journals, international and national conferences, and a web portal. The industry and law enforcement partners standardize the hardware and aid in the technical transfer process.