Bi-directional approach for logical traffic isolation forensic model

Abstract

Network forensics involves capturing, recording and analysing network activity in discovering the source of security policy violations or information assurance. The network forensic system that is described in this paper is called the "Catch-it-as-you-can" system, which seizes all packets passing through a certain traffic point, captures and writes them to the storage. The main aim of this paper is to address some of the challenges faced by the Logical Traffic Isolation (LTI) model, more specifically the incompleteness of evidence-gathering process. This study proposes the Bidirectional Logical Traffic Isolation model (BLTI) to improve evidence completeness by recording both the request and the response of the suspicious communication; rather than only the request (suspicious data) as Logical Traffic Isolation (LTI) did. The BLTI uses indexing methods to improve information recording and retrieval. Future research will continue with the evaluation of the BLTI model performance not covered in this paper.