Name
Abstract | ||
|---|---|---|
The source IP address where an offending activity had originated is of limited value because it does not specify a physical location, but an endpoint in a network for the sole purpose of routing. In addition, people and their devices move across the network, changing IP address as a consequence. It is useful to have some clues about where a device was at the time the offending action was performed. However, it would be desirable to correlate different pieces of evidence to discover other information, such as IP addresses used by the same device. Devices repeatedly accessing a private network, at different times, can be profiled by analyzing and correlating Network and Port Address Translation (NAPT) logs, in order to recognize recurring activity patterns. By mapping sequences of NAPT translations into multi-dimensional curves and computing a similarity measure on these, it is possible to group multiple different curves into common sets or profiles, that can be ascribed to individual users/machines. In this way, it is possible to recognize some of the users from their traffic peculiarities (browsing habits, mail access, network traffic generated by specific applications, etc.) without considering the exposed IP addresses. Experiments were performed on NAPT logs gathered in a campus network, with DHCP data providing control values for validation. |
Year | DOI | Venue |
|---|---|---|
2012 | 10.1109/IMIS.2012.125 | IMIS |
Keywords | Field | DocType |
device tracking,private networks,napt translation,multiple different curve,network traffic,napt log analysis,different piece,campus network,activity pattern,napt log,ip address,different time,private network,digital forensics,forensics,network forensics,payloads,internet,protocols,routing,network address translation | Computer security,Computer science,Network address translation,Computer network,Internet Connection Sharing,IP address management,Bogon filtering,IP forwarding,NAT traversal,Overlay network,IP tunnel | Conference |
Citations | PageRank | References |
5 | 0.56 | 7 |
Authors | ||
4 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Aniello Castiglione | 1 | 1206 | 93.97 |
| Alfredo De Santis | 2 | 4049 | 501.27 |
| Ugo Fiore | 3 | 670 | 43.02 |
| Francesco Palmieri | 4 | 1713 | 182.92 |