Exploring user requirements of network forensic tools

Abstract

Network forensic tools enable security professionals to monitor network performance and compromises. These tools are used to monitor internal and external network attacks. Technological improvements have enabled criminals to wipe out tracks of cybercrime to elude alterations. Network forensics procedures use processes to expedite investigation by tracking each original packet and event that is generated in the network. There are many network forensic tools, both open source and commercial versions available in the market. In this work, the result of a survey participated by different experts in open source network forensic tools have been presented. The advantages, challenges, and necessities have been identified for network forensic investigation of such tools. A few open source network forensic tools have been studied and performed a comparative analysis based on six key parameters. Further, two malware datasets are analyzed using open source tools to perform investigation and present a comprehensive network forensic analysis comprising IO graphs, Flow graphs, TCP stream, UDP multicast stream, mac-based analysis, and operating system analysis.