ForNet: Design and Implementation of a Network Forensics System

ForNet：网络取证系统的设计与实现Nasir Memon，Polytechnic University of NYAward 0430474摘要该项目提出解决缺乏有效工具来帮助调查Internet和其他基于IP的私有网络（如公司和政府网络）上的恶意活动。 该项目的总体目标是研究和论证建立适当的网络取证系统的技术可行性，并为这种基础设施奠定技术基础。 虽然网络取证系统背后的愿景和动机可能是令人信服的，但使其成为可能的算法和技术是具有挑战性的努力。 该原型系统将由名为SynApps的取证模块组成，这些模块将创建和存储进入和离开网络的数据包流量的智能概要。 多个此类取证模块将通过取证服务器联网。 法医服务器然后通过内联网或互联网联网，形成法医网络（ForNet），该项目的活动将与刑事司法专家合作进行，并将建立和部署一个在社区之间联网的小型原型系统。 理工大学的信息系统和互联网安全实验室（ISIS）将被用作将拟议的研究活动整合到ISIS安全测试平台上完成的课堂项目和本科生研究项目中的工具。ForNet将能够使用概要的网络流量来回答针对网络和系统的多种攻击调查中的问题。

ForNet: Design and Implementation of a Network Forensics SystemNasir Memon, Polytechnic University of NYAward 0430474AbstractThis project proposes to address the lack of effective tools for aiding investigation of malicious activity on the Internet and other private IP based networks such as corporate and government networks. The broad goal of this project is to study and demonstrate the technical feasibility of building an appropriate network forensics system and establish the technical foundations for such an infrastructure. Although the vision and motivation behind a network forensics system may be compelling, the algorithms and techniques that will make it possible are challenging endeavors.A proof of concept prototype network forensics system will be built. The prototype system will consist of forensics modules called SynApps that will create and store intelligent synopses of packet traffic entering and leaving a network. Multiple such forensics modules will be networked via a Forensics Server. The Forensics Servers are then networked across an intranet or the Internet to result in a Forensics Network (ForNet).The activities of the project will be carried out in co-operation with experts in criminal justice, and a small prototype system networked between the communities will be built and deployed. The Information Systems and Internet Security (ISIS) Laboratory at Polytechnic University will be used as the vehicle for integration of the proposed research activity into class projects and undergraduate research projects done on the security testbed in ISIS.The ForNet will be able use synopsized network traffic to answer questions in investigations of many varieties of attacks against networks and systems.