Modeling Network Forensics Behavior
Wei Zhong Ren · Journal of Digital Forensic Practice · 2006
Network forensics is a new approach to network security. However, this field is not very clear to new researchers and practitioners. In this paper, we discuss network forensics behavior systematically from both the technical view and legal view. The goal of this discussion is to outline the formalization and standardization of network forensics behavior. To our knowledge, this is the first comprehensive discussion of the network forensics model and its fundamental concepts, such as taxonomy, conceptual model, legal principles, key techniques, canonical processes and its accessory facilities and systems: network forensics architecture and deployment. These discussions will offer guidance to the standardization of network forensics processes and the implementation of prototype systems that can be used in digital forensic practice.