Letters

Network Forensic Technologies Utilizing
Communication Information
Takemi Nisase† and Mitsutaka Itoh
Abstract
Forensic analysis is becoming increasingly important as the means for enterprises to avoid information security risks. In this paper, we overview computer and network forensics focusing on network
forensic technologies that preserve all communication information and analyze it to investigate an incident.

1. What is Forensics?
Forensics is the application of science to questions
that are of interest to the legal system. For information security, there are two types of forensics: computer forensics and network forensics.
Forensics is applied after an incident occurs. It
involves analyzing information and collecting evi† NTT Information Sharing Platform Laboratories
Musashino-shi, 180-8585 Japan
E-mail: nisase.takemi@lab.ntt.co.jp

dence to determine what happened. Forensic results
are used to provide evidence in legal trials and to prevent similar incidents from happening again.
The position of forensics in the cycle of security
management is shown in Fig. 1. Forensics can bedivided into two processes: 1) the legal process for alawsuit related to an incident and 2) the technicalprocess that clarifies the vulnerabilities of the system
based on the cause of the incident and applies security measures. The results are used to support lawsuits
and improve daily operations. Furthermore, forensics
is used to review overall policy and guidelines.

Forensics
Legal process

Daily operationand management

Collection andpreservation ofevidence on
network

Establishment of
the security policy
guideline

Analysisof evidence

Lawsuitsupport etc.

incident
Technical process
Vulnerability
analysisPlanning of the wholepolicy of networkand service

Collection andpreservation ofevidence on hosts
and recovery

Designing of networkand proactive measure
enforcement

Enforcementof measures

Confirmationof the result

Operation andmanagement

Audit

Information security management cycle

Fig. 1. Position of forensics in the security management cycle.

Vol. 2 No. 8 Aug. 2004

83

Letters

2. Need for forensics

3. Computer forensics and network forensics

In Japan, security measures are becoming important as a result of the increase in damage and impact
of incidents caused by attacks and the increase inenterprise legal responsibility and dependence on IT
technologies. The introduction of defensive technology such as firewalls, patches, and anti-virus softwareis becoming commonplace in enterprise networks.
However, these proactive technologies cannot easily
handle attacks on newly discovered vulnerabilities.
On the other hand, the period from the discovery of avulnerability to the first attack based on it has shortened year by year, and “zero-day” attacks are predicted. Furthermore, Warhol worms*1 that can spreadaround the whole world within 15 minutes and evenflash worms that can start a DDoS (distributed denialof service) attack in even less time are predicted.
Under these circumstances, anti-virus software vendors are taking early precautions and measures using
new attack detecting technologies, but these cannot
be guaranteed to absolutely safe. Therefore, forensic
technology that provides assured countermeasuresand minimizes the various types of damage caused byincidents is needed.

Network forensics analyzes information about network devices while computer forensics analyzes
information residing on hosts (Fig. 2). Computer
forensics is explained as follows in an article on theJapanese National Police Agency’s Web site on hightech crime and cyber terrorism. [1] “Computer forensics secures evidence in the digital world by applying
computer science technology and aims to solve legalproblems. It covers techniques for analyzing data
inside a damaged computer (including falsified anddeleted logs and data) that is difficult to detect byexisting methods by using advanced tools and tracing
unlawful access.” Accordingly, advanced technologythat uses specialized tools for analyzing an attacked
host is needed.
Network forensics surveys communication logs
and other information about network devices, such asrouters, switches, and intrusion detection systems(IDSs*2). Then, it clarifies the attack time, the intruder’s IP (Internet protocol) address, the attack path,and other information about the intruder.
In the past, IDSs were used to collect the network
information, but recently network forensic devices
have begun to be introduced. These let us analyze an*1 Warhol worm is a term coined by Nicholas Weaver based on the
famous words of Andy Warhol: “In the future, everybody will
have 15 minutes of fame.” http://www.cs.berkeley.edu/~nweaver/warhol.html*2 Intrusion detection system: a system for detecting incidents inaccordance with the rules that describe the characteristics ofattacks.

Network forensics

Computer forensics
Analyzing logs, processes
and CPU usage conditions,and the conditions of disks
and files including tracing
deleted files

Collecting all packets on acommunication line andanalyzing stored data
corresponding to an incident
Network
forensic device

Switch fabricIntruderVictim hostCollecting traffic information andswitch fabric status and analyzing
how they relate to an incident

Fig. 2. Objectives of computer and network forensics.

84

NTT Technical Review

Letters

incident after it has occurred because they have large
memories and preserve copies of all the packets. One
reason network forensic devices have become possible is the fall in price of hard disks with capacities ofseveral hundred gigabytes. For example, a 300-GB
hard disk can preserve all the information for a week
in the case of 2% average bandwidth usage of a 100Mbit/s WAN (wide area network) circuit.
4. Relationship between the kind of incident andforensics
According to JPCERT/CC*3, an incident is “an artificial phenomenon concerning computer security
including intentional and also incidental things, suchas illegal use of resources, denial of services, destruction of data, unexpected disclosure of information,and various actions related to them.”
Every piece of information on the host and also on
the network related to solving incidents of various
kinds must be collected and analyzed. Table 1 shows
the main incident types and the information needed toanalyze them. An example of network traces for ordinary intrusions is shown in Fig. 3.

*3 JPCERT/CC (Japan Computer Emergency Response Team Coordination Center) http://www.jpcert.or.jp/english/

5. Characteristics and problems of network
forensics(1) Recognizing an attack
Intruders often scan hosts to search for ones having
vulnerabilities before making an actual intrusion.
Such a trial attack may also be carried out when a newvulnerability is discovered. Thus, when an incident
occurs it is important to analyze such precursory indications, even if this information is not related to anactual intrusion.
(2) Collecting evidence of intrusion when there
were attempts at concealment, deletion, or falsification
When an intruder succeeds in entering the target
host, he/she may conceal evidence on the host todelay discovery. In computer forensics, concealed
evidence can usually be found by professional tools,
but this requires advanced technology and discovery
is not assured. On the other hand, network forensic
devices collect and store communication information, so it is difficult for an intruder to hide it. Furthermore, the risks of falsification and deletion arelower because the intruder cannot directly access thestored information.
However, there are some problems with network
forensics.

Table 1. Types of incidents and information that should be collected.
Incident type
Illegal use ofresources

Incidents

Information (required)

Illegal use of processing power andstorage

Host: access log, status of process, CPU usage, and status offiles and storage

Illegal use of network bandwidth

Network: circuit status, numbers of sent and received
packets, IP address, protocol used, and status of switch
fabric port

Illegal relay of mail service and proxyserviceHost: application log and status of process
Network: IP address, protocol used, and data contents

Destabilization or stoppage of service
by consuming server resources

Host: process status, CPU usage, and unusual packet log
Network: circuit status, numbers of unusual packets,
IP address, and contents of unusual packet

Destabilization or stoppage ofcommunication by consuming network
bandwidth resources

Network: numbers of sent and received packets, IP address,protocol used, and data contents

Data destruction andfalsification

Falsification of Web pages, data files,
and program files

Host: access log, status of files and storage, and contents ofconfiguration files
Network: IP address, protocol used, data contents, and statusof switch fabric port

Information leakage

Leakage of secret/confidential contents
and interception of communication

Host: access log and status of files and storageNetwork: IP address, protocol used, data contents, and statusof switch fabric port

DoS
(denial of service)Vol. 2 No. 8 Aug. 2004

85

LettersServers for network management
Network forensic device

Mirror port
The Internet
Victim hostSwitch fabricIntruder

Traces of IPscanning

Intruder’s IP address,
scanning time, ID

Traces ofport scanning
Traces of theintrusion procedure

IP scanning (searching for a victim)

Collecting host information(searching for known vulnerabilities)
Attacking a host using a vulnerability

Traces of intruder’soperation and file transfer

Acquisition of administrator authority,falsifying and destroying data, andsetting up a backdoor in the victim

Traces of unusual
communication

Illegally using resources andleaking secret information

Fig. 3. Traces left on a network by ordinary intrusion methods.

(1) The data retention period decreases as the bandwidth increases
At present, the access bandwidth of the Internet isincreasing rapidly. Therefore, the disk capacity needed to preserve all the collected information is also
increasing rapidly. Conversely, the increase in communication bandwidth shortens the period of grace
from problem detection to countermeasures. For
example, a network forensic device with a memory
capacity of 1 TB can preserve data corresponding toabout 1.5 months in the case of 10% usage of a 10Mbit/s WAN circuit. However, it can preserve only
4.6 days of data for 10% usage of a 100-Mbit/s WAN
circuit. An effective way to solve these problems is to
use technology that enables the extension andexchange of memory storage during operation andthat automatically backs up preserved information toexternal memory storage.
(2) Security appliances may be attacked
The functions of security appliances are improving
to deal with sophisticated and complicated attacks
and in response to demands for advanced operability.
However, these advanced functions may make security appliances more vulnerable. For example, theattack against major IDS products was able to crashmany IDSs in February 2004. An operator may notrecognize an incident correctly after the security
appliance stops working and may assume that it is86

acting normally. Therefore, operators could overlook
important signs and the introduction of security
appliances could have the opposite effect to that
intended.
To solve such a problem, beside the operator always
applying the latest patch to the appliance, we needguidelines including ones about the operation flowfor handling the case when the appliance itself isinvolved.
(3) Encryption technology is spreading
Virtual private network (VPN) services using
encryption technology such as IPsec and SSL arebecoming popular as inexpensive enterprise network
access technology. The network forensic device thatcollects information about an encrypted communication can grasp the source and destination IP addresses and the time of communication, but it cannot
detect attack patterns or perform a detailed analysisof the commands used by an intruder, because it cannot analyze the contents of packets. Therefore, analysis requires an operator who can combine information from network forensic devices and information
about the victim host.
(4) Enterprise networks may be hit by insideattacks.
Careless operation on company premises and intentional inside attacks sometimes cause incidents inaddition to the attacks from the outside. IDS andNTT Technical Review

Letters(1) Computer forensic services(2) Network forensic services

Evidence collection andanalysis service

System integrator andproduct supplier service

Data recovery service

NSP’s optional service(3) Operation and management support services

Lawsuit support consulting service

Training and accreditation service

Fig. 4. Classification of MSSP’s forensic services in the U.S.A.

forensic devices need to be established inside a company premises network as well as at the boundary
between the company premises network and the outside to collect network information about internal
incidents. For a large-scale enterprise network, thenumber of devices is huge and the surveillance andoperating costs are high. Considering these problems,
some operation systems that manage many IDSs distributed on an enterprise network have beenannounced.
In response to problems (1) and (3) above, we areresearching a forensic architecture that coordinates
the information of IDSs arranged on the network andthe incident information collected by a host thatassures log integrity using secure/trusted OS (operating system) technology. For problem (1), by selectively preserving the most relevant information about
an incident, it is possible to reduce the disk capacityof the data storage device. For problem (3), detailed
analysis is possible by analyzing the relationshipbetween encrypted information on a network andhost information.
6. Trend in the U.S.A.
Let us look the trend of forensic services in theU.S.A., where managed security services are widespread and laws have been strengthened.
A managed security service provider (MSSP) may
classify forensics into services for computer forensics, network forensics, and operation support such as
training forensic engineers and providing lawsuit
support (Fig. 4).

Vol. 2 No. 8 Aug. 2004

(1) Computer forensic services(a) Evidence collection and analysis service
This service finds the data needed for a lawsuit
quickly out of the huge amount of data in a damaged computer system and preserves it as evidence.
The main MSSP offers an overall service in concert
with other MSSPs.
(b) Data recovery service
This service restores data that will become evidence of a crime or dishonest act. There are twotypes. A client either brings the storage media to theMSSP or allows the MSSP access to the client system via a network to recover data.
(2) Network forensic services(a) System integrator and product supplier service
When a security incident occurs, the MSSP uses
various security devices and logs, analyzes the correlation between events to reconstruct the processfrom occurrence to conclusion, and clarifies thecause and criminal evidence. For MSSPs, theirappliances are core technologies and they also offer
appliance management service.
(b) NSP’s optional service
This service offers a menu of intrusion detection
and firewall management services as an integral
part of the security service provided by network
service providers (NSPs). The NSP will remotely
monitor customer premises equipment (CPE) andmonitor connection points between a network andthe CPEs.
(3) Operation and management support services(a) Lawsuit support consulting service
This service provides consultation for strategy
87Letters

planning and data collection and also provides
experts to testify in court. An accounting firm offers
this service as an integral part of the consulting service related to judicial affairs.
(b) Training and accreditation service
This service provides training courses for computer forensic investigators and accreditation forsuch courses.

Takemi Nisase
Senior Research Engineer, Secure Communication Project, NTT Information Sharing Platform Laboratories.
He received the B.E. and M.E. degrees in electronic engineering from Tohoku University,Sendai, Miyagi in 1985 and 1987, respectively.
In 1987, he joined NTT Laboratories. He has
engaged in research on ATM voice communication (VTOA), VoIP (Voice over IP), and secure
IP communication (IP-VPN). He is currently
engaged in research on Internet security technology.

7. Trend in JapanThe forensic service market has not been established yet in Japan. However, forensic services arelikely to be introduced soon considering enterpriserisk control, the need for prompt responses to largescale information leakages, and new stricter laws
affecting enterprises.
Reference[1]88

http://www.cyberpolice.go.jp/column/explanation03.html (in Japanese)

Mitsutaka Itoh
Leader of Trusted Communication Group,Senior Research Engineer, Secure Communication Project, NTT Information Sharing Platform
Laboratories.
He received the B.S. and M.S. degrees in mathematics from Waseda University, Tokyo in 1982
and 1984, respectively. In 1984, he joined NTT
Laboratories and was engaged in R&D of programming languages, an Ada compiler, objectoriented design, cell phone systems, online-shopping services, ITS systems, IP-VPN service systems, and the resonant communication network.
His current interest is network security and trusted communications environments. He is a member of the Institute of Electronics, Information
and Communication Engineers of Japan.

NTT Technical Review