Visual Network Forensic Techniques and Processes

Abstract—Network forensics is the critical next step in the analysis of network attacks, intrusions, and misuses. It is the forensic process that will aid identification of what occurred and how. With the explosion in numbers and types of attacks it is critical that new techniques be developed to aid in the analysis of said attacks. For instance, with the recent widespread deployment of botnets, it is forensic techniques that will allow these botnets to be dissected to determine their extent, their capability, their control mechanisms, etc. In this paper we discuss visualization techniques designed around the analysis of network traffic data and tailored to the scalability issues intrinsic to such data. In conjunction with these techniques we discuss how these techniques fit into an analysts repertoire, how we foresee them being used, their advantages to the forensic process, and the process through which they will be effectively applied