TWC: Small: Developing Advanced Digital Forensic Tools Based on Network Stack Side Channels

该项目正在为渗透测试人员、数字取证专家和其他网络安全专业人员开发下一代网络测量工具，这些专业人员有时需要更多地了解互联网或特定网络。 它正在开发基于TCP/IP侧信道推断的技术，其中可以基于共享的有限资源的使用来推断远程机器对网络的看法。 正因为如此，作为该项目的一部分正在开发的工具能够克服现有工具（如traceroute和nmap）的基本限制。 例如，traceroute不能检测沿着路径的隧道，因为它只能从运行traceroute的机器的角度看到网络，而这里开发的方法可以在每一跳双向推断最大传输单元，从而提供有关潜在隧道的一些信息。 这一点很重要，因为犯罪分子经常使用隧道来隐藏他们的非法在线活动。研究团队计划在开源许可证下发布该项目开发的所有工具，以便网络安全从业者如何开展工作将发生范式转变。 TCP/IP侧信道有可能从根本上改变互联网和网络测量的科学。

This project is developing the next generation of network measurement tools for penetration testers, digital forensics experts, and other cybersecurity professionals who sometimes need to know more about the Internet or a specific network. It is developing techniques based on TCP/IP side channel inferences, where it is possible to infer something about a remote machine's view of the network based on the use of shared, limited resources. Because of this, the tools being developed as part of this project are able to overcome fundamental limitations of existing tools such as traceroute and nmap. For example, traceroute cannot detect tunnels along a path because it can only see the network from the perspective of the machine on which traceroute is running, whereas the methods being developed here can infer maximum transmission units bidirectionally at every hop and thus provide some information about potential tunnels. This is important because criminals often use tunnels to hide their illicit online activities.The research team plans to release all tools developed by this project under an open source license, so that there will be a paradigm shift in how cybersecurity practitioners conduct their jobs. TCP/IP side channels have the potential to change the science of Internet and network measurement in a fundamental way.