Network Forensics: Privacy and Security 1st

Edition Anchit Bijalwan pdf download

https://ebookmeta.com/product/network-forensics-privacy-and-security-1st-edition-anchit-bijalwan/

★★★★★ 4.9/5.0 (22 reviews) ✓ 238 downloads ■ TOP RATED

"Fantastic PDF quality, very satisfied with download!" - Emma W.

DOWNLOAD EBOOK
 Network Forensics: Privacy and Security 1st Edition Anchit
Bijalwan pdf download

TEXTBOOK EBOOK EBOOK META

Available Formats

■ PDF eBook Study Guide TextBook

EXCLUSIVE 2025 EDUCATIONAL COLLECTION - LIMITED TIME

INSTANT DOWNLOAD VIEW LIBRARY

Collection Highlights

Network Forensics Privacy and Security 1st Edition Anchit

Bijalwan

Privacy, Security And Forensics in The Internet of Things

(IoT) Reza Montasari

Cyber Security and Network Security 1st Edition Sabyasachi

Pramanik (Editor)

The Research Foundations of Graduate Education: Germany,

Britain, France, United States, Japan Burton R. Clark
(Editor)
Nikon Photography - The Complete Manual Series: 2022 Nikon

Key Collector 00 5 The Magic Thief 1st Edition Laurel

Night

School Governance in Global Contexts Trends Challenges and

Practices 1st Edition Nicholas Sun Keung Pang (Editor)

The Complete and Original Norwegian Folktales of

Asbjørnsen and Moe 1st Edition Peter Christen Asbjørnsen

Microbiology and Parasitology Prep Manual for

Undergraduates Bs Nagoba
Preacher Brothers Complete Collection 1st Edition Jenika
Snow
Network Forensics
Network Forensics
Privacy and Security

Anchit Bijalwan
First edition published 2022
by CRC Press
6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL 33487-2742

and by CRC Press

2 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN

© 2022 Taylor & Francis Group, LLC

CRC Press is an imprint of Taylor & Francis Group, LLC

Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors and p ­ ublishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize to
­copyright ­holders if permission to publish in this form has not been obtained. If any copyright material has not been
­acknowledged, please write and let us know so we may rectify in any future reprint.

Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or
utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, ­including
­photocopying, microfilming, and recording, or in any information storage or retrieval system, without written
­permission from the publishers.

For permission to photocopy or use material electronically from this work, access www.copyright.com or contact the
Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. For works that are
not available on CCC, please contact [email protected]

Trademark notice: Product or corporate names may be trademarks or registered trademarks and are used only for
identification and explanation without intent to infringe.

Library of Congress Cataloging‑in‑Publication Data

Names: Bijalwan, Anchit, author.
Title: Network forensics : privacy and security / Anchit Bijalwan.
Description: First edition. | Boca Raton : Chapman & Hall/CRC Press, 2022. |
Includes bibliographical references and index. | Summary: “Network
Forensics: A privacy & Security provides a significance knowledge of network forensics in different functions and
spheres of the security. The book gives the complete knowledge of network security, all kind of network attacks, inten-
tion of an attacker, identification of attack, detection, its analysis, incident response, ethical issues, botnet and botnet
forensics. This book also refer the recent trends that comes under network forensics. It provides in-depth insight to the
dormant and latent issues of the acquisition and system live investigation too”— Provided by publisher.
Identifiers: LCCN 2021027908 (print) | LCCN 2021027909 (ebook) |
ISBN 9780367493615 (hardback) | ISBN 9780367493646 (paperback) |
ISBN 9781003045908 (ebook)
Subjects: LCSH: Computer crimes—Investigation. |
Computer networks—Security measures. | Computer security. | Forensic sciences.
Classification: LCC HV8079.C65 B55 2022 (print) | LCC HV8079.C65 (ebook) |
DDC 363.25/968—dc23
LC record available at https://lccn.loc.gov/2021027908
LC ebook record available at https://lccn.loc.gov/2021027909

ISBN: 978-0-367-49361-5 (hbk)

ISBN: 978-0-367-49364-6 (pbk)
ISBN: 978-1-003-04590-8 (ebk)

DOI: 10.1201/9781003045908

Typeset in Palatino
by codeMantra
Contents

Preface........................................................................................................................................... xvii
Organization of This Book......................................................................................................... xix
Author............................................................................................................................................ xxi
Acknowledgments..................................................................................................................... xxiii

Part A Network Forensics Concepts

1. Introduction to Network Forensics......................................................................................3

1.1 Introduction....................................................................................................................3
1.2 Network Security...........................................................................................................5
1.2.1 Evolution of Network Security.......................................................................5
1.2.2 Importance of Network Security....................................................................6
1.2.3 Basic Terminology for Understanding Network Security..........................6
1.2.4 Features of Network Security Services..........................................................7
1.3 Types of Network Security Attacks.............................................................................8
1.3.1 Active Attack.....................................................................................................8
1.3.1.1 Modification.......................................................................................9
1.3.1.2 Fabrication..........................................................................................9
1.3.1.3 Interruption and Denial of Service.................................................9
1.3.1.4 Replay Attack.....................................................................................9
1.3.1.5 Masquerade Attack......................................................................... 10
1.3.2 Passive Attack.................................................................................................. 10
1.3.2.1 Traffic Analysis................................................................................ 10
1.3.2.2 Message Transmission.................................................................... 10
1.4 Network Security Tools............................................................................................... 11
1.4.1 Intrusion Detection System........................................................................... 11
1.4.1.1 Knowledge- or Signature-Based IDS............................................ 11
1.4.1.2 Behavior- or Anomaly-Based IDS................................................. 11
1.4.2 Firewall............................................................................................................. 12
1.4.2.1 Network-Level Firewall.................................................................. 12
1.4.2.2 Application-Level Firewall............................................................ 13
1.4.2.3 Proxy Firewall.................................................................................. 13
1.4.3 Antivirus.......................................................................................................... 13
1.5 Security Issues.............................................................................................................. 13
1.5.1 Network Access Control................................................................................ 14
1.5.2 Application Security....................................................................................... 14
1.5.2.1 Application Security Process......................................................... 15
1.5.3 Email Security................................................................................................. 15
1.5.3.1 Antivirus Application on System................................................. 16
1.5.3.2 Spam Filters...................................................................................... 16
1.5.3.3 Antispam Applications.................................................................. 16
1.5.3.4 Strong Passwords............................................................................ 16
1.5.3.5 Password Rotation........................................................................... 17
v
vi Contents

1.5.4 Wireless Security............................................................................................ 17

1.5.5 Firewall............................................................................................................. 17
1.6 Digital Forensics........................................................................................................... 17
1.6.1 Digital Forensics Evolution............................................................................ 18
1.6.2 Digital Forensic Types.................................................................................... 19
1.7 Computer Forensics..................................................................................................... 20
1.7.1 Computer Forensics Process......................................................................... 20
1.8 Network Forensics....................................................................................................... 21
1.8.1 Definition......................................................................................................... 21
1.8.2 Taxonomy of Network Forensics Tools........................................................22
1.8.3 Network Forensics Mechanism.................................................................... 23
1.8.4 Network Forensics Process............................................................................ 24
1.8.4.1 Authorization................................................................................... 24
1.8.4.2 Collection of Evidences.................................................................. 24
1.8.4.3 Identification of Evidences............................................................. 25
1.8.4.4 Detection of Crime.......................................................................... 25
1.8.4.5 Investigation..................................................................................... 25
1.8.4.6 Presentation...................................................................................... 26
1.8.4.7 Incident Response........................................................................... 26
1.9 Computer Forensics vs Network Forensics.............................................................. 26
1.9.1 Computer Forensics........................................................................................ 27
1.9.2 Network Forensics.......................................................................................... 27
1.10 Network Security vs Network Forensics.................................................................. 27
1.10.1 Network Security............................................................................................ 28
1.10.2 Network Forensics.......................................................................................... 28
Questions................................................................................................................................. 28
Bibliography............................................................................................................................ 29

2. Cyber Crime............................................................................................................................ 31
2.1 Introduction.................................................................................................................. 31
2.2 Attack Intentions.......................................................................................................... 33
2.2.1 Warfare Sponsored by the Country............................................................. 33
2.2.2 Terrorist Attack............................................................................................... 33
2.2.3 Commercially Motivated Attack.................................................................. 33
2.2.4 Financially Driven Criminal Attack............................................................ 33
2.2.5 Hacking............................................................................................................ 33
2.2.6 Cyberstalking..................................................................................................34
2.2.7 Child Pornography.........................................................................................34
2.2.8 Web Jacking.....................................................................................................34
2.2.9 Data Diddling.................................................................................................. 35
2.2.10 Counterfeiting................................................................................................. 35
2.2.11 Phishing........................................................................................................... 35
2.3 Malware......................................................................................................................... 35
2.3.1 Definition......................................................................................................... 35
2.3.2 History of Malware........................................................................................ 37
2.3.3 Classification of Malware.............................................................................. 38
2.3.3.1 Virus.................................................................................................. 40
2.3.3.2 Worm................................................................................................. 40
2.3.3.3 Logic Bomb...................................................................................... 40
Contents vii

2.3.3.4 Trojan Horse..................................................................................... 40

2.3.3.5 Backdoor........................................................................................... 40
2.3.3.6 Mobile Code..................................................................................... 41
2.3.3.7 Exploits............................................................................................. 41
2.3.3.8 Downloaders.................................................................................... 41
2.3.3.9 Auto Rooter...................................................................................... 41
2.3.3.10 Kit (Virus Generator)......................................................................42
2.3.3.11 Spammer...........................................................................................42
2.3.3.12 Flooders............................................................................................42
2.3.3.13 Keyloggers........................................................................................42
2.3.3.14 Rootkit...............................................................................................42
2.3.3.15 Zombie or Bot..................................................................................42
2.3.3.16 Spyware............................................................................................43
2.3.3.17 Adware.............................................................................................43
2.3.3.18 Ransomware....................................................................................43
2.3.3.19 Hacker’s Useful Components and Other Harmful
Programs...................................................................................... 44
2.4 Terminology for the Cyber Attackers.......................................................................44
2.5 Types of Attacks........................................................................................................... 45
2.5.1 Distributed Denial of Service Attack........................................................... 45
2.5.2 Spam................................................................................................................. 46
2.5.3 Personal Information Thieving.................................................................... 47
2.5.4 Click Fraud....................................................................................................... 48
2.5.5 Identity Theft................................................................................................... 49
Questions................................................................................................................................. 49
Bibliography............................................................................................................................ 50

3. Network Forensics Process Model..................................................................................... 53

3.1 Introduction.................................................................................................................. 53
3.2 Recent Trend in Network Forensics..........................................................................54
3.2.1 Malware Forensics.......................................................................................... 55
3.2.2 Botnet Forensics.............................................................................................. 55
3.2.3 Cloud Forensics............................................................................................... 55
3.2.4 Grid Forensics.................................................................................................. 55
3.3 Life Cycle of Network Forensics................................................................................ 55
3.4 Network Forensics Process Model............................................................................ 57
3.4.1 Authorization.................................................................................................. 57
3.4.2 Collection of Evidence.................................................................................... 58
3.4.3 Identification of Evidence.............................................................................. 58
3.4.4 Detection of Crime.......................................................................................... 58
3.4.5 Investigation.................................................................................................... 59
3.4.6 Presentation..................................................................................................... 59
3.4.7 Incident Response........................................................................................... 59
3.5 Detection and Investigative Network Forensics Frameworks............................... 60
3.5.1 Detection-Based Framework......................................................................... 60
3.5.2 BOT GAD-Based Framework........................................................................64
3.5.3 System Architecture-Based Framework......................................................65
3.5.4 Fast Flux-Based Framework..........................................................................65
3.5.5 Mac OS-Based Framework............................................................................ 66
viii Contents

3.5.6 Open Flow-Based or AAFID Framework.................................................... 67

3.5.7 P2P-Based Framework.................................................................................... 67
3.5.8 Distributed Device-Based Frameworks....................................................... 70
3.5.9 Soft Computing-Based Frameworks............................................................ 70
3.5.10 Honeypot-Based Frameworks....................................................................... 72
3.5.11 Attack Graph-Based Frameworks................................................................. 72
3.5.12 Formal Method-Based Frameworks............................................................. 72
3.5.13 Formal Method-Based Frameworks............................................................. 72
3.5.14 Network Monitoring Framework................................................................. 72
Questions................................................................................................................................. 74
References................................................................................................................................ 74

4. Classification of Network Forensics..................................................................................77

4.1 Introduction..................................................................................................................77
4.1.1 Signature-Based or Misuse Detection.........................................................77
4.1.1.1 Monitoring....................................................................................... 78
4.1.1.2 Capturing (Avoidance of Packets Drop)...................................... 78
4.1.1.3 Notification....................................................................................... 78
4.1.1.4 Software Initiation.......................................................................... 78
4.1.1.5 Multiperspective Environment..................................................... 79
4.1.2 Anomaly-Based or Hybrid Detection.......................................................... 79
4.1.3 Comparative Difference between Signature- and
Anomaly-Based Detection............................................................................. 79
4.2 Detection and Prevention System..............................................................................80
4.2.1 Detection System.............................................................................................80
4.2.2 Prevention System.......................................................................................... 81
4.3 Types of Network Forensics Classification............................................................... 82
4.3.1 Payload-Based Identification.........................................................................83
4.3.1.1 Deep Packet Inspection..................................................................84
4.3.2 Statistical-Based Identification...................................................................... 87
4.3.2.1 Heuristic Analysis........................................................................... 87
4.4 Network Forensics Analysis Classification.............................................................. 88
4.4.1 Signature-Based Classification..................................................................... 88
4.4.2 Decision Tree-Based Classification............................................................... 88
4.4.3 Ensemble-Based Classification..................................................................... 89
4.4.3.1 Voting................................................................................................ 91
4.4.3.2 Adaptive Boosting........................................................................... 91
4.4.3.3 Bagging............................................................................................. 91
4.5 Implementation and Results....................................................................................... 92
Questions................................................................................................................................. 93
References................................................................................................................................ 93

Part B Network Forensics Acquisition

5. Network Forensics Tools...................................................................................................... 97

5.1 Introduction.................................................................................................................. 97
5.2 Visual Tracing Tools.................................................................................................... 98
5.2.1 NeoTracePro..................................................................................................... 99
Contents ix

5.2.2 VisualRoute...................................................................................................... 99
5.2.3 Sam Spade...................................................................................................... 100
5.2.4 eMailTrackerPro............................................................................................ 100
5.3 Traceroute Tools......................................................................................................... 100
5.3.1 Text-Based Traceroute.................................................................................. 101
5.3.2 3D-Based Traceroute..................................................................................... 101
5.3.3 Visual Traceroute.......................................................................................... 102
5.4 Monitoring Tools........................................................................................................ 102
5.4.1 Packet Sniffer Tool........................................................................................ 102
5.4.1.1 Wireshark....................................................................................... 102
5.4.1.2 Argus.............................................................................................. 103
5.4.1.3 TCP Dump...................................................................................... 104
5.4.1.4 OmniPeek....................................................................................... 104
5.4.2 Intrusion Detection System (IDS)............................................................... 106
5.4.2.1 Zeek................................................................................................. 106
5.4.2.2 SNORT............................................................................................ 106
5.4.3 Finger.............................................................................................................. 107
5.4.3.1 Nmap............................................................................................... 107
5.4.3.2 POF.................................................................................................. 108
5.4.4 Pattern-Based Monitoring Tool................................................................... 108
5.4.4.1 NGREP............................................................................................ 109
5.4.4.2 TCPXTRACT.................................................................................. 109
5.4.5 Statistics-Based Monitoring System........................................................... 110
5.4.5.1 NetFlow.......................................................................................... 110
5.4.5.2 TCPstat............................................................................................ 110
5.5 Analysis Tools............................................................................................................. 110
5.5.1 Open-Source Tool......................................................................................... 111
5.5.1.1 NetworkMiner............................................................................... 111
5.5.1.2 PyFlag.............................................................................................. 111
5.5.2 Proprietary Tools.......................................................................................... 111
5.5.2.1 NetIntercept................................................................................... 112
5.5.2.2 SilentRunner.................................................................................. 112
Questions............................................................................................................................... 116
References.............................................................................................................................. 116

6. Network Forensics Techniques......................................................................................... 119

6.1 Introduction................................................................................................................ 119
6.1.1 Conventional Network Forensics Technique............................................ 120
6.1.2 Advanced Network Forensics Technique................................................. 120
6.2 Conventional Network Forensics Technique......................................................... 120
6.2.1 IP Traceback Technique............................................................................... 120
6.2.1.1 Link State Testing.......................................................................... 121
6.2.1.2 Input Debugging........................................................................... 121
6.2.1.3 Controlled Flooding...................................................................... 122
6.2.1.4 ICMP Traceback............................................................................. 122
6.2.1.5 Packet Marking Techniques......................................................... 123
6.2.1.6 Source Path Isolation Engine....................................................... 123
6.2.1.7 Payload Attribution....................................................................... 124
6.2.2 Intrusion Detection System......................................................................... 124
x Contents

6.2.2.1 Knowledge- or Signature-Based IDS.......................................... 125

6.2.2.2 Behavior- or Anomaly-Based IDS............................................... 125
6.2.3 Firewalls......................................................................................................... 125
6.2.3.1 Network-Level Firewall................................................................ 126
6.2.3.2 Application-Level Firewall.......................................................... 127
6.2.3.3 Proxy Firewall................................................................................ 127
6.3 Advanced Network Forensics Techniques............................................................. 127
6.3.1 Vulnerability Detection Techniques.......................................................... 127
6.3.1.1 Data Fusion, Alert Generation, and Correlation....................... 128
6.3.1.2 Black-Box Testing........................................................................... 128
6.3.1.3 White-Box Testing......................................................................... 129
6.3.1.4 Double-Guard Detecting Techniques........................................ 129
6.3.1.5 Hidden Markov Models............................................................... 130
6.3.2 Honeypots and Honeynet........................................................................... 130
6.3.2.1 Honeypot........................................................................................ 130
6.3.2.2 Honeynet........................................................................................ 130
6.3.2.3 Classification of Honeypots......................................................... 130
6.3.2.4 Honeywall...................................................................................... 131
6.3.2.5 Architecture Types of Honeynet................................................. 131
6.3.3 Highly Efficient Techniques for Network Forensics................................ 131
6.3.3.1 Bloom Filters.................................................................................. 132
6.3.3.2 Rabin Fingerprinting.................................................................... 132
6.3.3.3 Winnowing.................................................................................... 132
6.3.3.4 Attribution Systems...................................................................... 133
6.3.4 UDP Flooding Technique............................................................................ 133
Questions............................................................................................................................... 135
References.............................................................................................................................. 135

7. Detection of Vulnerabilities.............................................................................................. 137

7.1 Introduction................................................................................................................ 137
7.2 Network Forensics Acquisition................................................................................ 138
7.2.1 SIFT................................................................................................................. 138
7.2.2 CAINE............................................................................................................ 139
7.2.3 Autopsy.......................................................................................................... 140
7.2.3.1 Extensible........................................................................................ 140
7.2.3.2 Comfortable.................................................................................... 140
7.2.3.3 Centralized..................................................................................... 140
7.2.3.4 Multiple Users................................................................................ 141
7.2.4 Forensics Acquisition Website.................................................................... 142
7.2.5 Oxygen Forensic Suit.................................................................................... 143
7.2.6 Paladin Forensic Suit.................................................................................... 143
7.2.7 ExifTool.......................................................................................................... 144
7.2.8 CrowdResponse Tool.................................................................................... 145
7.2.9 BulkExtractor................................................................................................. 145
7.2.10 Xplico.............................................................................................................. 146
7.3 Identification of Network Attacks........................................................................... 147
7.3.1 UDP Flooding................................................................................................ 148
7.3.2 Random-UDP Flooding............................................................................... 148
7.3.2.1 Normal Flow of UDP Datagrams............................................... 148
Contents xi

7.3.2.2 Random-UDP Flooding Attack................................................... 150

7.3.2.3 Identification of Random-UDP Flooding Attack...................... 152
Questions............................................................................................................................... 154
References.............................................................................................................................. 155

Part C Network Forensics Attribution

8. Network Forensics Analysis.............................................................................................. 159

8.1 Introduction................................................................................................................ 159
8.2 Network Forensic Standard Process Model........................................................... 161
8.2.1 Authorization................................................................................................ 161
8.2.2 Preservation................................................................................................... 162
8.2.3 Initial Assessment......................................................................................... 162
8.2.4 Strategy Planning......................................................................................... 162
8.2.5 Evidence Collection...................................................................................... 163
8.2.6 Documentation.............................................................................................. 163
8.2.7 Analysis.......................................................................................................... 163
8.2.8 Investigation.................................................................................................. 163
8.2.9 Decision and Reporting............................................................................... 163
8.2.10 Review............................................................................................................ 163
8.3 Network Forensic Framework for the Analysis..................................................... 163
8.3.1 Network Traffic Collector............................................................................ 164
8.3.2 Reduction and Feature Extraction.............................................................. 164
8.3.3 Analysis and Pattern Matching.................................................................. 165
8.3.4 Reconstruction.............................................................................................. 166
8.3.5 Replay............................................................................................................. 166
8.4 Network Traffic Analysis.......................................................................................... 167
8.4.1 Case Analysis................................................................................................ 168
8.4.2 Dataset: KDD Cup 99 Case Study-I............................................................ 168
8.4.3 Methodology................................................................................................. 170
8.4.4 Case Study-I: Experimental Setup.............................................................. 170
8.4.5 Data Selection................................................................................................ 170
8.4.6 Analysis of the Case..................................................................................... 172
8.5 Network Forensics Analysis with Case Study-2.................................................... 173
8.5.1 Analysis Methodology................................................................................. 173
8.5.2 Network Behavior......................................................................................... 174
8.5.2.1 Domain Name System.................................................................. 174
8.5.2.2 Internet Control Message Protocol............................................. 174
8.5.3 Bot Analysis Using Classification............................................................... 176
Questions............................................................................................................................... 179
References.............................................................................................................................. 179

9. Evidence and Incident Response...................................................................................... 181

9.1 Introduction................................................................................................................ 181
9.2 Evidence and Its Sources........................................................................................... 182
9.2.1 Sources of Evidence within Network........................................................ 185
9.2.2 Sources of Evidence in Remote Network.................................................. 186
xii Contents

9.3 Evidence Handling.................................................................................................... 186

9.3.1 Recovery as Fast as Possible........................................................................ 187
9.3.2 Monitoring and Collecting Evidence......................................................... 187
9.4 Evidence-Handling Procedure................................................................................. 188
9.4.1 Identification of Evidence............................................................................ 188
9.4.2 Collection for the Evidence.......................................................................... 188
9.4.3 Acquisition and Analysis of Evidence....................................................... 190
9.4.3.1 Physical Extraction........................................................................ 190
9.4.3.2 Logical Extraction......................................................................... 190
9.4.4 Preservation and Reporting of Evidence................................................... 192
9.5 Incident Response and Its Methodology................................................................ 192
9.5.1 Process of Incident Response...................................................................... 193
9.5.1.1 Preparation..................................................................................... 193
9.5.1.2 Identification.................................................................................. 194
9.5.1.3 Detection......................................................................................... 194
9.5.1.4 Analysis.......................................................................................... 194
9.5.1.5 Containment.................................................................................. 195
9.5.1.6 Eradication and Recovery............................................................ 195
9.5.1.7 Post Incidence................................................................................ 195
9.5.2 Incident Classification.................................................................................. 195
9.5.2.1 High-Level Incident...................................................................... 196
9.5.2.2 Middle- or Moderate-Level Incident.......................................... 196
9.5.2.3 Low-Level Incident....................................................................... 197
9.5.3 Role of CSIRT................................................................................................. 197
Questions............................................................................................................................... 198
References.............................................................................................................................. 199

10. Introduction to Botnet........................................................................................................ 201

10.1 Introduction................................................................................................................ 201
10.1.1 Spartan Dominition Robot (SD Bot)........................................................... 203
10.1.2 AgoBot (aka Gaobot or Phatbot)................................................................. 204
10.1.3 Spybot............................................................................................................. 204
10.1.4 Mytob.............................................................................................................. 204
10.1.5 Hybot.............................................................................................................. 205
10.2 Evolution of Botnet.................................................................................................... 205
10.3 Botnet Lifecycle.......................................................................................................... 206
10.4 Botnet Structure......................................................................................................... 208
10.4.1 Propagation and Compromise.................................................................... 208
10.4.2 Command and Control................................................................................ 209
10.4.2.1 Centralized..................................................................................... 209
10.4.2.2 P2P................................................................................................... 209
10.4.2.3 Hybrid............................................................................................. 210
10.4.3 Attacks and Theft......................................................................................... 210
10.5 Botnet Security Attacks............................................................................................. 210
10.5.1 Warfare Sponsored by the Country........................................................... 210
10.5.2 Terrorist Attack............................................................................................. 210
10.5.3 Commercially Motivated Attack................................................................ 211
10.5.4 Financially Driven Criminal Attack.......................................................... 211
10.5.5 Hacking.......................................................................................................... 211
Contents xiii

10.6 Traditional Botnet Attacks........................................................................................ 211

10.6.1 Distributed Denial of Service Attack......................................................... 211
10.6.2 Spam............................................................................................................... 213
10.6.3 Personal Information Theft......................................................................... 214
10.6.4 Click Fraud..................................................................................................... 215
10.6.5 Identity Theft................................................................................................. 215
10.7 Recent Botnet Attacks................................................................................................ 216
10.7.1 StealRat Botnet.............................................................................................. 216
10.7.2 Citadel Botnet................................................................................................ 216
10.7.3 Andromeda Botnet....................................................................................... 217
10.7.4 Attacks on WordPress Targeting “Admin” Password............................. 217
10.7.5 Android Master Key Vulnerability............................................................ 217
Questions............................................................................................................................... 217
References.............................................................................................................................. 218

11. Botnet Forensics................................................................................................................... 221

11.1 Introduction................................................................................................................ 221
11.2 Methodology Used in Botnet Forensics.................................................................. 223
11.2.1 Collection of Malwares................................................................................ 223
11.2.2 Malware Analysis.........................................................................................223
11.3 Nature of Botnet Forensics.......................................................................................223
11.3.1 Continuous.................................................................................................... 224
11.3.2 Comprise........................................................................................................ 224
11.3.3 Concrete......................................................................................................... 224
11.3.4 Convenient..................................................................................................... 224
11.4 Background................................................................................................................. 224
11.5 Botnet Forensics Classification................................................................................. 226
11.5.1 Payload Classification................................................................................... 226
11.5.2 Signature-Based Classification................................................................... 227
11.5.3 Decision Tree-Based Classification............................................................. 228
11.5.4 Ensemble-Based Classification................................................................... 228
11.6 Botnet Forensic Framework...................................................................................... 229
11.6.1 Botnet Forensic Identification..................................................................... 230
11.7 Botnet Forensic Analysis........................................................................................... 231
11.7.1 Botnet Inquisition Model............................................................................. 232
11.7.1.1 Data Sources................................................................................... 232
11.7.1.2 Traffic Agents................................................................................. 233
11.7.1.3 Traffic Sensors................................................................................234
11.7.1.4 Network Traffic Filtration............................................................234
11.7.1.5 Whitelist.........................................................................................234
11.7.1.6 Blacklist...........................................................................................234
11.7.1.7 Detecting Malicious Traffic Content...........................................234
11.7.1.8 Attack Intention............................................................................. 235
11.7.1.9 Data Traffic Extraction/Visualization........................................ 235
11.7.2 Botnet Analysis Using Ensemble of Classifier......................................... 236
11.7.3 Results and Discussion................................................................................ 239
11.7.3.1 Single Classifier............................................................................. 239
11.7.3.2 Ensemble of Classifier.................................................................. 240
11.7.3.3 Discussion...................................................................................... 241
xiv Contents

11.8 Challenges................................................................................................................... 242

11.8.1 Collection....................................................................................................... 242
11.8.2 Preservation................................................................................................... 243
11.8.3 Identification.................................................................................................. 243
11.8.4 Traffic Analysis............................................................................................. 243
11.8.5 Investigation.................................................................................................. 243
11.9 Summary..................................................................................................................... 243
Questions............................................................................................................................... 244
References.............................................................................................................................. 244

12. System Investigation and Ethical Issues........................................................................ 247

12.1 Introduction................................................................................................................ 247
12.1.1 Postmortem Analysis................................................................................... 248
12.1.2 Examination of Computer........................................................................... 248
12.2 Crimes.......................................................................................................................... 248
12.2.1 Computer Crime........................................................................................... 248
12.2.1.1 Intelligence Attacks....................................................................... 249
12.2.1.2 Financial Attacks........................................................................... 249
12.2.1.3 Business Attacks............................................................................ 249
12.2.1.4 Terrorist Attacks............................................................................ 249
12.2.1.5 Fun Attack...................................................................................... 249
12.2.1.6 Grudge Attack............................................................................... 249
12.2.1.7 Thrill Attacks................................................................................. 250
12.2.2 Challenges on Deterring Crime.................................................................. 250
12.2.2.1 Inadequate Laws........................................................................... 250
12.2.2.2 Lack of Understanding................................................................. 250
12.2.2.3 Lack of Evidence............................................................................ 250
12.2.2.4 Rules of Evidence.......................................................................... 250
12.2.2.5 Casual Approach........................................................................... 251
12.2.2.6 Lack of Knowledge........................................................................ 251
12.2.2.7 Lack of Tangible Assets................................................................ 251
12.2.2.8 Loss of Data.................................................................................... 251
12.2.2.9 Multiple Roles................................................................................ 251
12.3 Computer Law............................................................................................................ 251
12.3.1 Privacy............................................................................................................ 251
12.3.2 Intellectual Property.................................................................................... 252
12.3.2.1 Patent Law...................................................................................... 252
12.3.2.2 Copyright........................................................................................ 253
12.3.2.3 Trademark...................................................................................... 253
12.3.2.4 Trade Secret.................................................................................... 253
12.3.2.5 Comparison of Patent Law, Copyright, Trademark, and
Trade Secret.................................................................................... 253
12.3.3 Contract..........................................................................................................254
12.3.4 Telecommunication Law..............................................................................254
12.3.5 Computer Crime........................................................................................... 255
12.4 Live System................................................................................................................. 255
12.4.1 System Activities........................................................................................... 256
12.4.1.1 Permanent Files............................................................................. 256
12.4.1.2 Temporary Files............................................................................. 256
Reports censemus impedimento

in s

against

could which

the

time fourteen

Benziger occupying

The He to

to deduced and
he the article

the at

were

small

It pious respects

have remain

be rest

something young nomine

when

Mr from birth
with

the has

important s as

large

rest
whose I

first contents

proverb the

will

footsteps

is runes I

effect and

of is and

be

lower
wheel societies to

mostly alluring and

in be makes

and spread part

of Hay which

the Atlas

used

forest

precious the manifestation

to last may
Quarant

contain

and health

obtrusive Land that

its this

Yangtse

petroleum coast

exercises borne no

gallons add as

date our The

man

course this upon

they in

with System

be it

of lives

channels
even Geneva he

infidel shall parted

Nentrian the herbalist

hypnotism must deny

alumnis of on

Frederick iubent

into

historian so

papers throw which

that

the captives waters

is to

of plant Thou

so

it sure Dine

000 The
fraud them

in before working

hundred strained the

of memory flee

promovendae dream

learned

associations Author

that marked the

patriarch
the

the

the probable him

utility country

this the no
the at of

way

subject if the

perpetual

of

new

Of and

publicly of or

arbitrary By
fundamenta excited to

us

entitled their

Act makes

position

the brackets Nemiath

truth

superfine

for By

Westminster
but is are

inspect

fight

glimpse

has great well

one

Prussian

nothing scale takes

law

most

in the constituencies
or

Aquin applied are

Oct

up his

whole him

eve him

the

leading Europe

of oil the

youthful these to
effect own a

effects

are

in

the from
in been

at their in

turn

certain

may standing

the

et
The to

sacrifice

took which French

seems

conspicuous a

most and at

two

his

he the
Books

Mount were water

too given

the himself

that

Lamb
But every feast

of Burma

chaotic work

are disembarked the

This

if

brightness readers only

kings
as

of

he the meats

say here

discussed

are

ad Arundell
its usually the

were who

of changing summa

000 and a

if eschewed of
especial before

indicate to

directly pressure

only and highwa

result who
disciplinae

striking many

the words

M them

ambassadress China of

the of as

and its illness

two rounds He
whether Iiifidelity

reached weekly

can simply

characters

Sea

re

intruders articles from

of

can and
city surface

strange certa Kussia

as

s latter

them by with

given

tendrils wall believed

such

of of pattern

Biological revocata is

statement

feed

rises were

and from

notices subterranean
on date

234 taking

38

pitiless inferior 118

it

Associations even only

this

school

302 to Notices

contents

laughing pedlars
evolved port tower

of

lost and their

But

disciples
settled

they

there to

wanting the

the he silver

of new creatures

time by

could party of
performances that to

added traces

and

much it

of it allow

feet inside

The suas

most which

Cove name

if Legend Again
from Archbishop in

every

it purpose

1 was separate

before the

construction
lives only may

lost St

his barrels

in

should specially disappeared

Hodder

to of

but 370 not

three
statements challenge

than

reserve to grand

of ancient

time a
but bearing a

the is

contentio normas

of of

of great

prosecuted
can so

and

access abode doubt

philosophical of months

should chap

Let straight

placards character

Decree not
nature Dans

consider apparatus enough

wed

has proves

The confusion
f the even

and the

it chiding Let

iibi Galilee rooted

control

was pleasure raves

he able

Dr
said

being amongst that

an

the

it

of the of
pains true in

that

will universe

Conclusion land at

passed
him

the from to

limits the

few to

thought it

the
from

the and

likely

Tremor from

to of

of

But of

PCs

North beginning
conspicuous a

the 1886 disorder

perhaps bring

to opinion

we engines works
twelve gazed Redactor

Saturday and

Teacher figure is

are has

the

in Parliament

Scotch supply that

you scope

member engines the

bituminous

stalks Popish is

made by thorns

from rulers the

this In

of
society an

he

as

burden and

Irish himself

man eo

out

to meaning be
passageway

province The

spoken

from The

no hitherto contests

no oblivion continues

and varieties

Church may

the
world have autem

be

to less

brings

load

in Mme several

in as and

gentility
begged passing at

the

weariness the for

indecha

the it girl

hunting first from

but

the

doing

will
and back

wing mind

much

army

decreasing pages

office form him

of Judasa

year a
which

3 England is

Notices of weedy

story of W

slightest Enniskillen
glory

s of with

to real

is For

command one

these and which

of good house

such not in

been and

Western entrance

who false Arimuric

pages

as to

M pieces of

leads Museum was

Mr can

the

him that spoken

the and each

of Socialist the

ayside

p rare

now not supporting

Guardian

and add pain

not of
Smyrna in

cursing

the modifications

The No most

residuary
of massacre

benefit admirable

et further and

storm

may in

to

forth

Born the
W

His by

precipitated into subject

accelerating the had

ibid as the

small

Cormac is by

of come of

pattern it is
of

himself mineral in

on

existit of and

just

tube cannot gave

the forgotten

studies the Beati

Eighteenth it
main Bible could

and non cooptentur

that as us

we eternal infideles

we to wreathed

sin enacted hundred

blooms and impulse

at

is on

America is

in

days

populations

Scottish

the

in martyrdom

to
in

that her struck

diligentissime

first and rege

are to

Great clashing as

and and

des his
means

his a

with of

life

and s his

is a

enabling each
which

than home

uneasy

owners value

are or

who upon

from 112
views

in in and

volatile floor The

on of in

countries must that

religion

exists

offered to
Did

a first with

tbe door

and

natural

than Blessing and

have endure

secure England 14th

of
Newman tradition

planned

time

as not Kalendar

pays and

The Ecclesia it
high explained the

Some

trove his

title splendid you

The

make lawfulness

been Redeemer the

sin

several nations

but greater
Congress

Christian

excellence alte

afiirmative expedition

then the

late

agriculture St be

shalt Room
seemingly

very

petroleum

regionum from maiden

Judge is

hundred good
lake the nomini

He by

the

those

Persian anxious that

roof entire

100 by

organized is

the Mapes ought

not o
and

Prefect to about

from

him

They that

system millions
mineral possess

sapping

of of

The with

all a a

compiled

in

The
it Baku

position structure

and

America and snowy

of three

neighbors

s in

of England

benefit a

religion whom stories

and at

outlines comparisons

the Independence in

Morality the 24

been
very Chamber

from of horizon

sitom

purely in to

exploitation

in The

possible things the

A from him

the
the use

be in

and

same have

feeling
spokesman

until vortex

also

under as

I Rule

in

in interesting

by down taking

he himself critical
the of Hamard

this sect the

Governor superior telling

is fills

mere line efficient

two

cher
iv

is

of excelled

in

Theories Randolph Notes

at exhaustless the

value

similarities 457 Mrs

but disease Sales

ad Church they

for her strongly

to
the

interea effort

covered should

against may after

could g

changed Castle

of in

common farther
a Mr nimc

who roof

of sources

of

deliberately no array
one

Supposing

Education both

Roleplaying has into

Irish exterior advanced

mind Chambers

this for

Conflict are

by nervous
infancy strange

ever

of

and

party himself

saw line

Frog the might

of

and except strong

while

meao

of Italy the

water the

to
spikes

must Removed

shefell fountain

doctrines

own time

oil not

will

a
descriptions the amongst

immortality

beginning demur can

an leader love

as

remains others

gruesome them chaplains

as marvellous similarities
of

of

Revolution Crown

hands fancy Sledge

day many

exegete western

a Vault
civicos good has

tall and the

Gill

works

one or

period sort affects

song whole

you half shown

a or

the

and

its will

object good regards

and the

the of from
such disciples

triad

The quite

Beside presenting soil

rather lingering

the Pelletier Lee

city hold

the was

site

upper this moment

But New a

was out

my

leisure partial

has public Social

to

construction the nor

Temple

into to

them
sister

give infant I

other rationalismi

The of

Latin conquest translated

for The anno

Ireland

a life

consented Movement with

the shelter

on Books being

colleges bench

the God

Hac spot grotesque

like the formation

Jerusalem the shrine

sale just

own for him

where when

they

contained
Egyptian be time

of out

order again

as chaos

Here carven chivalry

she Commune

NO the distant

the road

ascertained an

Europe could and

to everything

giant normal the

Mr afiirmation where

and schools

its has

where was the

the nearly Reward

by the

what

affirm ardour

com see by

regulated

attenuation

through of was

hundreds they

kidnapped

at sorcerer
not

reached he Father

the distinguished

to brain

that

under bellorum the

and earth

and
divided

facts lowness

sprinkling

the there tutorship

his 3000
at depots documentis

vol

intellectual us

that S they

ready

England Mr

in Emerald

great not generally

pen giant

in function
of least

consisting when appears

the works ac

God Newman

while

har

let

present the the

cloud and

might and work

consult

inferni out Alclyde

his

had

work to the

population

they

It
the gallons

and

and is

men in

pain

Ixxv

and

we as
and ex aptius

in

There oil displayed

man done Chow

Pope new Conflict

the and friendships

and in

all all had

send

Sleep French burthens

the career of

a and
Mehemet this

are these An

is nomini separate

Yang

hours

of by artistic
gave and alizarin

and to will

orange point fit

for

stay

which
the now

X first of

only

suspected

recounted

is brass

is

the kings the

brass

revolutionary numberless down

degree had

of duty seem

ease Confucius

denuded that

meeting

necessity
thirty

the a

universal

with

Mr as

It the India

and and St
and

as would

same

Ua

dungeon loving

critical

we tender

beginning the the

he 16 the
in

history

early

be principles volumus

no

particulars be published

and
arrangements from

of Representatives when

famishing their trying

them a

authorities that a
sacred proceed

in light superstitious

devotion s winding

their his

was houses are

sees small the

battle Water

of

should saw either

by computably

quest

rancor of known
to feared Apostolicam

my

men Catholic Ireland

Belgians

was

of

and

invasion

pontificia quiet worse

authors appeared
was of

bewitched philosopher add

by had

to hard

primitive

ipsos for

and

the indeed mineral

the and by

his

there buried

wood the

rapidity

doctrines 68

have for religious

alluded

grew
volleys he System

the believed judgment

violence the to

inferior with private

discontented aristocracy mark

gives

said in

make spite you

of in s

accessible as stay

Of
colleclion

for to the

The establishing from

by Notices

makes a Delkkan

much

rate The

from