A new approach to executable file fragment detection in network forensics

Dat TRAN; Wanli MA; Dharmendra SHARMA

doi:10.1007/978-3-319-11698-3_40

A new approach to executable file fragment detection in network forensics

Dat TRAN
, Wanli MA
, Dharmendra SHARMA

Information Systems

Research output: A Conference proceeding or a Chapter in Book › Conference contribution › peer-review

2 Downloads (Pure)

Abstract

Network forensics known as an extended phase of network security plays an essential role in dealing with cybercrime. The performance of a network forensics system heavily depends on the network attack detection solutions. Two main types of network attacks are network level and application level. Current research methods have improved the detection rate but this is still a challenge. We propose a Shannon entropy approach to this study to identify executable file content for anomaly-based network attack detection in network forensics systems. Experimental results show that the proposed approach provides high detection rate

Original language	English
Title of host publication	International Conference on Network and System Security (NSS 2014)
Editors	Man Ho Au, Barbara Carminati, C.-C Jay Kuo
Place of Publication	Germany
Publisher	Springer
Pages	510-517
Number of pages	8
Volume	8792
ISBN (Electronic)	9783319116983
ISBN (Print)	9783319116976
DOIs	https://doi.org/10.1007/978-3-319-11698-3_40
Publication status	Published - 2014
Event	The 8th International Conference on Network and System Security 2014 - Xian, Xian, China Duration: 15 Oct 2014 → 17 Oct 2014

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	8792
ISSN (Print)	0302-9743

Conference

Conference	The 8th International Conference on Network and System Security 2014
Country/Territory	China
City	Xian
Period	15/10/14 → 17/10/14

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 16 Peace, Justice and Strong Institutions

Access to Document

10.1007/978-3-319-11698-3_40

Cite this

@inproceedings{3e3bb13121c04a898d86dd4d565af92e,

title = "A new approach to executable file fragment detection in network forensics",

abstract = "Network forensics known as an extended phase of network security plays an essential role in dealing with cybercrime. The performance of a network forensics system heavily depends on the network attack detection solutions. Two main types of network attacks are network level and application level. Current research methods have improved the detection rate but this is still a challenge. We propose a Shannon entropy approach to this study to identify executable file content for anomaly-based network attack detection in network forensics systems. Experimental results show that the proposed approach provides high detection rate",

keywords = "Executable data detection, Machine learning, Network forensics, File fragment detection",

author = "Dat TRAN and Wanli MA and Dharmendra SHARMA",

year = "2014",

doi = "10.1007/978-3-319-11698-3\_40",

language = "English",

isbn = "9783319116976",

volume = "8792",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "510--517",

editor = "Au, \{Man Ho\} and Barbara Carminati and Kuo, \{C.-C Jay\}",

booktitle = "International Conference on Network and System Security (NSS 2014)",

address = "Netherlands",

note = "The 8th International Conference on Network and System Security 2014 ; Conference date: 15-10-2014 Through 17-10-2014",

}

TRAN, D, MA, W & SHARMA, D 2014, A new approach to executable file fragment detection in network forensics. in MH Au, B Carminati & C-CJ Kuo (eds), International Conference on Network and System Security (NSS 2014). vol. 8792, Lecture Notes in Computer Science, vol. 8792, Springer, Germany, pp. 510-517, The 8th International Conference on Network and System Security 2014, Xian, China, 15/10/14. https://doi.org/10.1007/978-3-319-11698-3_40

A new approach to executable file fragment detection in network forensics. / TRAN, Dat; MA, Wanli; SHARMA, Dharmendra.
International Conference on Network and System Security (NSS 2014). ed. / Man Ho Au; Barbara Carminati; C.-C Jay Kuo. Vol. 8792 Germany: Springer, 2014. p. 510-517 (Lecture Notes in Computer Science; Vol. 8792).

Research output: A Conference proceeding or a Chapter in Book › Conference contribution › peer-review

TY - GEN

T1 - A new approach to executable file fragment detection in network forensics

AU - TRAN, Dat

AU - MA, Wanli

AU - SHARMA, Dharmendra

PY - 2014

Y1 - 2014

N2 - Network forensics known as an extended phase of network security plays an essential role in dealing with cybercrime. The performance of a network forensics system heavily depends on the network attack detection solutions. Two main types of network attacks are network level and application level. Current research methods have improved the detection rate but this is still a challenge. We propose a Shannon entropy approach to this study to identify executable file content for anomaly-based network attack detection in network forensics systems. Experimental results show that the proposed approach provides high detection rate

AB - Network forensics known as an extended phase of network security plays an essential role in dealing with cybercrime. The performance of a network forensics system heavily depends on the network attack detection solutions. Two main types of network attacks are network level and application level. Current research methods have improved the detection rate but this is still a challenge. We propose a Shannon entropy approach to this study to identify executable file content for anomaly-based network attack detection in network forensics systems. Experimental results show that the proposed approach provides high detection rate

KW - Executable data detection

KW - Machine learning

KW - Network forensics

KW - File fragment detection

UR - https://www.scopus.com/pages/publications/84908679368

U2 - 10.1007/978-3-319-11698-3_40

DO - 10.1007/978-3-319-11698-3_40

M3 - Conference contribution

SN - 9783319116976

VL - 8792

T3 - Lecture Notes in Computer Science

SP - 510

EP - 517

BT - International Conference on Network and System Security (NSS 2014)

A2 - Au, Man Ho

A2 - Carminati, Barbara

A2 - Kuo, C.-C Jay

PB - Springer

CY - Germany

T2 - The 8th International Conference on Network and System Security 2014

Y2 - 15 October 2014 through 17 October 2014

ER -

A new approach to executable file fragment detection in network forensics

Abstract

Publication series

Conference

UN SDGs

Access to Document

Other files and links

Fingerprint

Cite this