FORWEB: file fingerprinting for automated network forensics investigations

Authors:
John Haggerty;David Llewellyn-Jones;Mark Taylor
Affiliations:
Liverpool John Moores University, Byrom Street, Liverpool, UK;Liverpool John Moores University, Byrom Street, Liverpool, UK;Liverpool John Moores University, Byrom Street, Liverpool, UK
Venue:
Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
Year:
2008

Citing 5
Cited 1

Network performance effects of HTTP/1.1, CSS1, and PNG

SIGCOMM '97 Proceedings of the ACM SIGCOMM '97 conference on Applications, technologies, architectures, and protocols for computer communication
Fingerprinting and forensic analysis of multimedia

Proceedings of the 12th annual ACM international conference on Multimedia
Fast and automated generation of attack signatures: a basis for building self-protecting servers

Proceedings of the 12th ACM conference on Computer and communications security
Computational forensic techniques for intellectual property protection

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems
Early detection and prevention of denial-of-service attacks: a novel mechanism with propagated traced-back attack blocking

IEEE Journal on Selected Areas in Communications

Feature: Forensic investigation of peer-to-peer networks

Network Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

A major advantage of information technology is the ease, speed and volume of information that may be shared between hosts. However, this has given rise to concerns over paedophile activity and the spread of malicious digital pictures amongst this community. In network forensic investigations a wealth of information relevant to the investigation will reside within the network itself and on disparate hosts. Current computer forensics tools are designed for the analysis of seized hard drives rather than investigating data within a network. In this paper we present FORWEB, a novel scheme for automated file fingerprinting of malicious pictures resident on Web servers. This approach may be used in forensic investigations to automatically identify repositories of malicious digital pictures on the Internet or to verify the Internet usage of a suspect. A case study and its results demonstrate the applicability of this approach.