Creating Learning Materials and Strategies for Network Forensics Education

该项目的目标包括：(1)开发一个复杂和现实的教育基础设施，为本科生和研究生的网络取证课程提供有趣和现实的网络犯罪场景；(2)开发具有创新教育工具包的系统实验室项目，如用于在三维空间收集证据的无线定位机器人。综合的形成性和总结性评估被用来确保这个项目的成功。该项目采用现实的网络平台，提供分布式匿名通信系统和无线网络等网络犯罪现场的广泛覆盖。它利用PlanetLab，一个提供覆盖服务并支持新网络服务开发的全球研究网络。在这种环境下，作者设计了一套用于网络取证教学的工具包，其中包括DeAnonymizer工具包，该工具包通过专业匿名通信网络（如Anonymizer和Tor）对可疑网络流量进行水印跟踪。另一个工具，3DLoc，在三维空间中搜索可疑的移动设备。开发的网络取证项目和支持材料在国家科学数字图书馆（NSDL）创建了一个存储库。PI为不同规模的学校提供详细的文件和免费咨询，并通过计算机教育和研究期刊、国际和国内会议以及门户网站等各种渠道传播该计划的成果。行业和执法合作伙伴将硬件标准化，并在技术转让过程中提供帮助。

Computer Science (31) The objectives of this project include (1) developing a sophisticated and realistic educational infrastructure which provides interesting and realistic cyber-crime scenes for undergraduate and graduate network forensics curricula, and (2) developing systematic laboratory projects with innovative educational toolkits such as wireless positioning robots for collecting evidence in a 3-dimensional space. Comprehensive formative and summative evaluations are used to ensure the success of this project.The project uses realistic network platforms and provides a wide coverage of cyber-crime scenes such as distributed anonymous communication systems and wireless networks. It utilizes PlanetLab, a global research network that provides overlay services and supports the development of new network services. The proposer designed a set of toolkits for teaching network forensics in this environment, including DeAnonymizer toolkit which traces suspects by watermarking the suspect network traffic through professional anonymous communication networks such as Anonymizer and Tor. Another toolkit, 3DLoc, searches the suspect mobile device in a 3-dimensional space.The developed network forensics projects and supporting materials create a repository at the National Science Digital Library (NSDL). The PI provides detailed documents and free consulting for schools of different sizes and disseminates the outcomes of this project via various venues such as computer education and research journals, international and national conferences, and a web portal. The industry and law enforcement partners standardize the hardware and aid in the technical transfer process.