File Detection On Network Traffic Using Approximate Matching
<p>In recent years, Internet technologies changed enormously and allow faster Internet connections, higher data rates and mobile usage. Hence, it is possible to send huge amounts of data / files easily which is often used by insiders or attackers to steal intellectual property. As a consequenc...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Association of Digital Forensics, Security and Law
2014-09-01
|
| Series: | Journal of Digital Forensics, Security and Law |
| Online Access: | http://ojs.jdfsl.org/index.php/jdfsl/article/view/261 |
| _version_ | 1818358675597688832 |
|---|---|
| author | Frank Breitinger Ibrahim Baggili |
| author_facet | Frank Breitinger Ibrahim Baggili |
| author_sort | Frank Breitinger |
| collection | DOAJ |
| description | <p>In recent years, Internet technologies changed enormously and allow faster Internet connections, higher data rates and mobile usage. Hence, it is possible to send huge amounts of data / files easily which is often used by insiders or attackers to steal intellectual property. As a consequence, data leakage prevention systems (DLPS) have been developed which analyze network traffic and alert in case of a data leak. Although the overall concepts of the detection techniques are known, the systems are mostly closed and commercial.</p><p>Within this paper we present a new technique for network trac analysis based on approximate matching (a.k.a fuzzy hashing) which is very common in digital forensics to correlate similar files. This paper demonstrates how to optimize and apply them on single network packets. Our contribution is a straightforward concept which does not need a comprehensive conguration: hash the file and store the digest in the database. Within our experiments we obtained false positive rates between 10<sup>-4</sup> and 10<sup>-5</sup> and an algorithm throughput of over 650 Mbit/s.</p> |
| first_indexed | 2024-12-13T20:32:46Z |
| format | Article |
| id | doaj.art-1e57138e637f408e9410bb4a8aaa1ba8 |
| institution | Directory Open Access Journal |
| issn | 1558-7215 1558-7223 |
| language | English |
| last_indexed | 2024-12-13T20:32:46Z |
| publishDate | 2014-09-01 |
| publisher | Association of Digital Forensics, Security and Law |
| record_format | Article |
| series | Journal of Digital Forensics, Security and Law |
| spelling | doaj.art-1e57138e637f408e9410bb4a8aaa1ba82022-12-21T23:32:22ZengAssociation of Digital Forensics, Security and LawJournal of Digital Forensics, Security and Law1558-72151558-72232014-09-01922336167File Detection On Network Traffic Using Approximate MatchingFrank Breitinger0Ibrahim Baggili1University of New HavenUniversity of New Haven<p>In recent years, Internet technologies changed enormously and allow faster Internet connections, higher data rates and mobile usage. Hence, it is possible to send huge amounts of data / files easily which is often used by insiders or attackers to steal intellectual property. As a consequence, data leakage prevention systems (DLPS) have been developed which analyze network traffic and alert in case of a data leak. Although the overall concepts of the detection techniques are known, the systems are mostly closed and commercial.</p><p>Within this paper we present a new technique for network trac analysis based on approximate matching (a.k.a fuzzy hashing) which is very common in digital forensics to correlate similar files. This paper demonstrates how to optimize and apply them on single network packets. Our contribution is a straightforward concept which does not need a comprehensive conguration: hash the file and store the digest in the database. Within our experiments we obtained false positive rates between 10<sup>-4</sup> and 10<sup>-5</sup> and an algorithm throughput of over 650 Mbit/s.</p>http://ojs.jdfsl.org/index.php/jdfsl/article/view/261 |
| spellingShingle | Frank Breitinger Ibrahim Baggili File Detection On Network Traffic Using Approximate Matching Journal of Digital Forensics, Security and Law |
| title | File Detection On Network Traffic Using Approximate Matching |
| title_full | File Detection On Network Traffic Using Approximate Matching |
| title_fullStr | File Detection On Network Traffic Using Approximate Matching |
| title_full_unstemmed | File Detection On Network Traffic Using Approximate Matching |
| title_short | File Detection On Network Traffic Using Approximate Matching |
| title_sort | file detection on network traffic using approximate matching |
| url | http://ojs.jdfsl.org/index.php/jdfsl/article/view/261 |
| work_keys_str_mv | AT frankbreitinger filedetectiononnetworktrafficusingapproximatematching AT ibrahimbaggili filedetectiononnetworktrafficusingapproximatematching |