The research, conducted under the auspices of Purdue's Center for Education and Research in Information Assurance and Security, aims to find a way to match TCP streams in a network to identify patterns that point to an attacker. If a firm is the victim of a series of attacks, it could install a device to record data about the TCP streams involved in the attacks. This data, such as the timing of the streams and packet sizes, would be matched with data collected by similar devices elsewhere on the network, potentially letting law enforcement identify similar patterns leading to the perpetrator. Shields is focusing on properties that don't require looking inside packets, so the technology will work with encrypted streams. He acknowledges his research could raise privacy concerns, but says the intention is to use the technology only when it is legally and socially desirable to identify someone.
Shields hopes to have a prototype in place by next spring.
From Forensics International. Secure Data Technologies Corporation Includes an overview of network forensics. List of Federal experts at solving computer crime From the Department of Justice. Crime Mapping Research Center From the Department of Justice. Feedback Tell us your thoughts on this article or the issues raised in it.