Skip to main content

2021 | OriginalPaper | Buchkapitel

Large Scale Graph Based Network Forensics Analysis

verfasst von : Lorenzo Di Rocco, Umberto Ferraro Petrillo, Francesco Palini

Erschienen in: Pattern Recognition. ICPR International Workshops and Challenges

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

In this paper we tackle the problem of performing graph based network forensics analysis at a large scale. To this end, we propose a novel distributed version of a popular network forensics analysis algorithm, the one by Wang and Daniels [18].
Our version of the Wang and Daniels algorithm has been formulated according to the MapReduce paradigm and implemented using the Apache Spark framework. The resulting code is able to analyze in a scalable way graphs of arbitrary size thanks to its distributed nature. We also present the results of an experimental study where we assessed both the time performance and the scalability of our algorithm when run on a distributed system of increasing size.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
1.
Zurück zum Zitat Alabdulsalam, S.K., Duong, T.Q., Choo, K.-K.R., Le-Khac, N.-A.: evidence identification and acquisition based on network link in an internet of things environment. In: Herrero, Á., Cambra, C., Urda, D., Sedano, J., Quintián, H., Corchado, E. (eds.) CISIS 2019. AISC, vol. 1267, pp. 163–173. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-57805-3_16CrossRef Alabdulsalam, S.K., Duong, T.Q., Choo, K.-K.R., Le-Khac, N.-A.: evidence identification and acquisition based on network link in an internet of things environment. In: Herrero, Á., Cambra, C., Urda, D., Sedano, J., Quintián, H., Corchado, E. (eds.) CISIS 2019. AISC, vol. 1267, pp. 163–173. Springer, Cham (2021). https://​doi.​org/​10.​1007/​978-3-030-57805-3_​16CrossRef
4.
Zurück zum Zitat Cattaneo, G., Ferraro Petrillo, U., Nappi, M., Narducci, F., Roscigno, G.: An efficient implementation of the algorithm by Lukáš et al. on Hadoop. In: Au, M.H.A., Castiglione, A., Choo, K.-K.R., Palmieri, F., Li, K.-C. (eds.) GPC 2017. LNCS, vol. 10232, pp. 475–489. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-57186-7_35CrossRef Cattaneo, G., Ferraro Petrillo, U., Nappi, M., Narducci, F., Roscigno, G.: An efficient implementation of the algorithm by Lukáš et al. on Hadoop. In: Au, M.H.A., Castiglione, A., Choo, K.-K.R., Palmieri, F., Li, K.-C. (eds.) GPC 2017. LNCS, vol. 10232, pp. 475–489. Springer, Cham (2017). https://​doi.​org/​10.​1007/​978-3-319-57186-7_​35CrossRef
5.
Zurück zum Zitat Corey, V., Peterman, C., Shearin, S., Greenberg, M.S., Van Bokkelen, J.: Network forensics analysis. IEEE Internet Comput. 6(6), 60–66 (2002)CrossRef Corey, V., Peterman, C., Shearin, S., Greenberg, M.S., Van Bokkelen, J.: Network forensics analysis. IEEE Internet Comput. 6(6), 60–66 (2002)CrossRef
6.
Zurück zum Zitat Cybercrime Magazine: Global Cybercrime Damages Predicted To Reach \$6 Trillion Annually By 2021 (2018). cybersecurityventures.com/cybercrime-damages-6-trillion-by-2021 Cybercrime Magazine: Global Cybercrime Damages Predicted To Reach \$6 Trillion Annually By 2021 (2018). cybersecurityventures.com/cybercrime-damages-6-trillion-by-2021
7.
Zurück zum Zitat Dave, A., Jindal, A., Li, L.E., Xin, R., Gonzalez, J., Zaharia, M.: GraphFrames: an integrated API for mixing graph and relational queries. In: Proceedings of the Fourth International Workshop on Graph Data Management Experiences and Systems, pp. 1–8 (2016) Dave, A., Jindal, A., Li, L.E., Xin, R., Gonzalez, J., Zaharia, M.: GraphFrames: an integrated API for mixing graph and relational queries. In: Proceedings of the Fourth International Workshop on Graph Data Management Experiences and Systems, pp. 1–8 (2016)
8.
Zurück zum Zitat Dean, J., Ghemawat, S.: MapReduce: simplified data processing on large clusters. Commun. ACM 51, 107–113 (2008)CrossRef Dean, J., Ghemawat, S.: MapReduce: simplified data processing on large clusters. Commun. ACM 51, 107–113 (2008)CrossRef
9.
Zurück zum Zitat Dijkstra, E.W., et al.: A note on two problems in connexion with graphs. Numerische mathematik 1(1), 269–271 (1959)MathSciNetCrossRef Dijkstra, E.W., et al.: A note on two problems in connexion with graphs. Numerische mathematik 1(1), 269–271 (1959)MathSciNetCrossRef
10.
Zurück zum Zitat Ferraro Petrillo, U., Roscigno, G., Cattaneo, G., Giancarlo, R.: Informational and linguistic analysis of large genomic sequence collections via efficient Hadoop cluster algorithms. Bioinformatics 34(11), 1826–1833 (2018)CrossRef Ferraro Petrillo, U., Roscigno, G., Cattaneo, G., Giancarlo, R.: Informational and linguistic analysis of large genomic sequence collections via efficient Hadoop cluster algorithms. Bioinformatics 34(11), 1826–1833 (2018)CrossRef
11.
Zurück zum Zitat Ferraro Petrillo, U., Sorella, M., Cattaneo, G., Giancarlo, R., Rombo, S.E.: Analyzing big datasets of genomic sequences: fast and scalable collection of k-mer statistics. BMC Bioinform. 20(4), 1–14 (2019) Ferraro Petrillo, U., Sorella, M., Cattaneo, G., Giancarlo, R., Rombo, S.E.: Analyzing big datasets of genomic sequences: fast and scalable collection of k-mer statistics. BMC Bioinform. 20(4), 1–14 (2019)
12.
Zurück zum Zitat Garcia, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Comput. Secur. 45, 100–123 (2014)CrossRef Garcia, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Comput. Secur. 45, 100–123 (2014)CrossRef
13.
Zurück zum Zitat He, J., Chang, C., He, P., Pathan, M.S.: Network forensics method based on evidence graph and vulnerability reasoning. Future Internet 8(4), 54 (2016)CrossRef He, J., Chang, C., He, P., Pathan, M.S.: Network forensics method based on evidence graph and vulnerability reasoning. Future Internet 8(4), 54 (2016)CrossRef
15.
Zurück zum Zitat Lynch, N.A.: Distributed Algorithms. Morgan Kaufmann, San Francisco (1996)MATH Lynch, N.A.: Distributed Algorithms. Morgan Kaufmann, San Francisco (1996)MATH
16.
Zurück zum Zitat Malewicz, G., et al.: Pregel: a system for large-scale graph processing. In: Proceedings of the 2010 ACM SIGMOD International Conference on Management of Data, pp. 135–146 (2010) Malewicz, G., et al.: Pregel: a system for large-scale graph processing. In: Proceedings of the 2010 ACM SIGMOD International Conference on Management of Data, pp. 135–146 (2010)
17.
Zurück zum Zitat Pelaez, J.C., Fernandez, E.B.: VoIP network forensic patterns. In: 2009 Fourth International Multi-Conference on Computing in the Global Information Technology, pp. 175–180. IEEE (2009) Pelaez, J.C., Fernandez, E.B.: VoIP network forensic patterns. In: 2009 Fourth International Multi-Conference on Computing in the Global Information Technology, pp. 175–180. IEEE (2009)
19.
Zurück zum Zitat Xin, R.S., Gonzalez, J.E., Franklin, M.J., Stoica, I.: GraphX: a resilient distributed graph system on spark. In: First International Workshop on Graph Data Management Experiences and Systems, pp. 1–6 (2013) Xin, R.S., Gonzalez, J.E., Franklin, M.J., Stoica, I.: GraphX: a resilient distributed graph system on spark. In: First International Workshop on Graph Data Management Experiences and Systems, pp. 1–6 (2013)
Metadaten
Titel
Large Scale Graph Based Network Forensics Analysis
verfasst von
Lorenzo Di Rocco
Umberto Ferraro Petrillo
Francesco Palini
Copyright-Jahr
2021
DOI
https://doi.org/10.1007/978-3-030-68821-9_39