Evaluation of network traffic analysis using approximate matching algorithms - Advances in Digital Forensics XVII Access content directly
Conference Papers Year : 2021

Evaluation of network traffic analysis using approximate matching algorithms

Abstract

Approximate matching has become indispensable in digital forensics as practitioners often have to search for relevant files in massive digital corpora. The research community has developed a variety of approximate matching algorithms. However, not only data at rest, but also data in motion can benefit from approximate matching. Examining network traffic flows in modern networks, firewalls and data loss prevention systems are key to preventing security compromises.This chapter discusses the current state of research, use cases, validations and optimizations related to applications of approximate matching algorithms to network traffic analysis. For the first time, the efficacy of prominent approximate matching algorithms at detecting files in network packet payloads is evaluated, and the best candidates, namely TLSH, ssdeep, mrsh-net and mrsh-cf, are adapted to this task. The individual algorithms are compared, strengths and weaknesses highlighted, and detection rates evaluated in gigabit-range, real-world scenarios. The results are very promising, including a detection rate of 97% while maintaining a throughput of 4 Gbps when processing a large forensic file corpus. An additional contribution is the public sharing of optimized prototypes of the most promising algorithms.
Fichier principal
Vignette du fichier
522103_1_En_5_Reference.pdf (451.92 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03764372 , version 1 (31-08-2022)

Licence

Attribution

Identifiers

Cite

Thomas Göbel, Frieder Uhlig, Harald Baier. Evaluation of network traffic analysis using approximate matching algorithms. 17th IFIP International Conference on Digital Forensics (DigitalForensics), Feb 2021, Virtual, China. pp.89-108, ⟨10.1007/978-3-030-88381-2_5⟩. ⟨hal-03764372⟩
24 View
2 Download

Altmetric

Share

Gmail Facebook X LinkedIn More