Visible to the public Network Reconnaissance Investigation: A Memory Forensics Approach

TitleNetwork Reconnaissance Investigation: A Memory Forensics Approach
Publication TypeConference Paper
Year of Publication2019
AuthorsAl-Saleh, Mohammed I., Al-Sharif, Ziad A., Alawneh, Luay
Conference Name2019 10th International Conference on Information and Communication Systems (ICICS)
ISBN Number978-1-7281-0045-6
Keywordsinformation forensics, Network reconnaissance, pubcrawl, resilience, Resiliency, Scalability
Abstract

Perpetrators utilize different network reconnaissance techniques in order to discover vulnerabilities and conduct their attacks. Port scanning can be leveraged to conclude open ports, available services, and even running operating systems along with their versions. Even though these techniques are effective, their aggressiveness for information gain could leave an apparent sign of attack, which can be observed by the variety of security controls deployed at the network perimeter of an organization. However, not all such attacks can be stopped nor the corresponding security controls can defend against insiders. In this paper, we tackle the problem of reconnaissance detection using a different approach. We utilize the rich information that is kept in memory (or RAM). We observe that packets sent or received stay in memory for a while. Our results show that inspecting memory for attack signs is beneficial. Furthermore, correlating contents that are obtained from different memories empowers the investigation process and helps reach to conclusions.

URLhttps://ieeexplore.ieee.org/document/8809084
DOI10.1109/IACS.2019.8809084
Citation Keyal-saleh_network_2019