An Identity and Interaction Based Network Forensic Analysis

2025-03-24

AI Summary

Existing network forensic analysis tools (NFATs) struggle to identify genuine user identities and reconstruct application-layer behaviors from encrypted traffic, as IP addresses fail to capture intrinsic user characteristics. To address this, we propose a novel NFAT paradigm that— for the first time—integrates user identity modeling and application-layer interaction intent inference directly into encrypted traffic analysis. Our approach synergistically combines traffic fingerprinting, multi-granularity temporal behavioral modeling, and incremental classification learning. We further design an interpretable, query-enabled visualization interface to enhance investigative efficiency and evidentiary admissibility. Evaluated on a custom dataset comprising 50 million packets, our method achieves an average true positive rate of 93.3% across 27 users, with full (100%) identification for 41% of them. Notably, it demonstrates superior performance on services including Skype, Wikipedia, and Hotmail.

Technology Category

• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models
• Machine Learning: Privacy
• Humans and AI: Intelligent User Interfaces

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

In todays landscape of increasing electronic crime, network forensics plays a pivotal role in digital investigations. It aids in understanding which systems to analyse and as a supplement to support evidence found through more traditional computer based investigations. However, the nature and functionality of the existing Network Forensic Analysis Tools (NFATs) fall short compared to File System Forensic Analysis Tools (FS FATs) in providing usable data. The analysis tends to focus upon IP addresses, which are not synonymous with user identities, a point of significant interest to investigators. This paper presents several experiments designed to create a novel NFAT approach that can identify users and understand how they are using network based applications whilst the traffic remains encrypted. The experiments build upon the prior art and investigate how effective this approach is in classifying users and their actions. Utilising an in-house dataset composed of 50 million packers, the experiments are formed of three incremental developments that assist in improving performance. Building upon the successful experiments, a proposed NFAT interface is presented to illustrate the ease at which investigators would be able to ask relevant questions of user interactions. The experiments profiled across 27 users, has yielded an average 93.3% True Positive Identification Rate (TPIR), with 41% of users experiencing 100% TPIR. Skype, Wikipedia and Hotmail services achieved a notably high level of recognition performance. The study has developed and evaluated an approach to analyse encrypted network traffic more effectively through the modelling of network traffic and to subsequently visualise these interactions through a novel network forensic analysis tool.

Problem

• Develops NFAT to identify users in encrypted network traffic
• Improves analysis of user interactions with network applications
• Evaluates performance via experiments with 50 million packets

Innovation

• Identify users via encrypted network traffic
• Model network traffic for forensic analysis
• Visualize interactions with novel NFAT interface