Device tracking in private networks via NAPT log analysis

Proceedings - 6th International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, IMIS 2012

Volumn , Issue , 2012, Pages 603-608

  Castiglione, Aniello ^a   De Santis, Alfredo ^a   Fiore, Ugo ^b   Palmieri, Francesco ^c  

^a UNIVERSITY OF SALERNO   (Italy)

^b UNIVERSITY OF NAPLES FEDERICO II   (Italy)

^c SECOND UNIVERSITY OF NAPLES   (Italy)

Author keywords

Device Tracking; Digital Forensics; IP Networks; Log Analysis; Network Address Translation; Network Forensics; Network Investigation; Similarity Matching

Indexed keywords

DIGITAL FORENSIC; IP NETWORKS; LOG ANALYSIS; NETWORK ADDRESS TRANSLATIONS; NETWORK FORENSICS; SIMILARITY-MATCHING;

INTERNET; UBIQUITOUS COMPUTING;

COMPUTER NETWORKS;

EID: 84867731060     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IMIS.2012.125     Document Type: Conference Paper

References (21)

1. P. Srisuresh and M. Holdrege, "RFC 2663 - IP Network Address Translator (NAT) Terminology and Considerations," http://tools.ietf.org/ html/rfc2663.
2. V. P. Kafle and M. Inoue, "Locator ID separation for mobility management in the new generation network," Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications (JoWUA), vol. 1, no. 2/3, pp. 3-15, 10 2010.
3. "Google IPv6 Statistics," http://www.google.com/intl/en/ipv6/ statistics/.
4. M. Ponec, P. Giura, J. Wein, and H. Brönnimann, "New payload attribution methods for network forensic investigations," ACM Trans. Inf. Syst. Secur., vol. 13, pp. 15:1-15:32, March 2010.
5. Y. Tang and T. Daniels, "A simple framework for distributed forensics," in 25th IEEE International Conference on Distributed Computing Systems Workshops, 2005. IEEE, 2005, pp. 163-169.
6. S. Kornexl, V. Paxson, H. Dreger, A. Feldmann, and R. Sommer, "Building a time machine for efficient recording and retrieval of high-volume network traffic," in Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement. USENIX Association, 2005, pp. 23-23.
7. M. Afanasyev, T. Kohno, J. Ma, N. Murphy, S. Savage, A. C. Snoeren, and G. M. Voelker, "Privacy-preserving network forensics," Commun. ACM, vol. 54, no. 5, pp. 78-87, 2011.
8. T. A. Kosa, K. EI-Khatib, and S. Marsh, "Measuring privacy," Journal of Internet Services and Information Security (JISIS), vol. 1, no. 4, pp. 60-73, 11 2011.
9. E. Claise, B., "RFC 5101 - Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information," http://tools.ietf.org/html/rfc5101.
10. P. Srisuresh and M. Holdrege, "RFC 2616 - Hypertext Transfer Protocol - HTTP/1.1," http://tools.ietf.org/html/rfc2616.
11. H. Alt and M. Godau, "Computing the fréchet distance between two polygonal curves," Int. J. Comput. Geometry Appl., vol. 5, pp. 75-91, 1995.
12. T. Eiter and H. Mannila, "Computing discrete Fréchet distance," Christian Doppler Laboratory for Expert Systems, TU Vienna, Austria, Tech. Rep. CD-TR 94/64, 1994.
13. K. Buchin, M. Buchin, and Y. Wang, "Exact algorithms for partial curve matching via the Fréchet distance," in SODA, C. Mathieu, Ed. SIAM, 2009, pp. 645-654.
14. NAT: Local and Global Definitions, Cisco, http://www.cisco.com/image/gif/ paws/4606/8.pdf.
15. "BGP Toolkit," http://bgp.he.net/.
16. "Alexa Top 500 Global Sites," http://www.alexa.com/topsites.
17. M. Cotton and L. Vegoda, "RFC 5735 - Special Use IPv4 Addresses," http://tools.ietf.org/html/rfc5735.
18. T. Fawcett, "Roc graphs with instance-varying costs," Pattern Recognition Letters, vol. 27, no. 8, pp. 882-891, 2006.
19. I. Witten and E. Frank, Data Mining: Practical machine learning tools and techniques. Morgan Kaufmann, 2005.
20. J. Cohen et al., "A coefficient of agreement for nominal scales," Educational and psychological measurement, vol. 20, no. 1, pp. 37-46, 1960.
21. F. Palmieri and U. Fiore, "Network anomaly detection through nonlinear analysis," Computers & Security, vol. 29, no. 7, pp. 737-755, 2010.