Abstract:The Internet now plays a pivotal role in the social and economic landspace, providing individuals and businesses with access to essential daily services and tasks. However, it has also become a breeding ground for conflicts. Advanced Persistent Threats (APTs) pose a formidable chanllenge when directed at organizations and governments, exposing the entire network to substantial security risks. Employing network fornesics for attributing cyber-attacks and acquiring timely, credible forensic results is a fundamental challenge in maintaining cyber security. This paper introduces a Deep Learning-based network forensics framework for digitally identifying and tracking network attacks, providing a comprehensive overview of the network forensics process. Specifically, we extract network traffic and employ encryption to ensure the integrity and security of data. Subsequently, we apply feature filtering techniques to retain essential traceability information, and Deep Learning model parameters are automatically optimized using hyperparameter optimization techniques. Lastly, we develop a Multi-Layer Perceptual Deep Neural Network (MLP DNN) model with perceptual capabilities for detecting anomalous events within the network. We evaluated the framework’s effectiveness using the UNSW-NB15 dataset. The experiments demonstrate that the proposed framework is applicable to APT attack forensics scenarios. In comparison to other AI methods, our framework excels in discovering and tracking network attack events with high performance.

Research on Network Forensics Based on Cause and Effect of Time Series

Attack Graph Analysis for Network Anti-Forensics.

Fuzzy Decision Tree Based Inference Techniques for Network Forensic Analysis

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

A Novel Network Forensic Framework for Advanced Persistent Threat Attack Attribution Through Deep Learning

Study on Social Network Forensics

Tools and techniques for Network Forensics

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

Wavelet-based analysis of network security databases

Modeling and Analyzing Dynamic Forensics System Based on Intrusion Tolerance

Automated Analysis of Multi-Source Logs for Network Forensics

Comprehend Network Situation Using Time Series Data Mining And Time Frequency Analysis

Social Network Forensics Analysis Model Based on Network Representation Learning

Forensic Model for DDoS Attack

Frequent Attack Sequences-based Network log Mining

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

HiSec: Towards Cyber Threat Correlation and Discovery Based on Hierarchical Graph Neural Networks

Computer Network Security Analysis Modeling Based on Spatio-temporal Characteristics and Deep Learning Algorithm

Classification of Network Attack Source Tracing Technologies

A proposed architecture for network forensic system in large-scale networks

Research on Key Technologies of Network Security Situational Awareness for Attack Tracking Prediction