# Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning
## 4 Experiments and Analysis
### Experiment with External Datasets  
To perform a more comprehensive experiment and to be able to compare our experiment results to those from some existing methods, in particular the work by [PERSON] [3], we employed MIT Lincoln Lab DARPA 2000 LLDOS 1.0 dataset and MIT Lincoln Lab 2000 DARPA intrusion detection scenario 2.0.2 [5] in this experiment. The datasets were generated in the MIT Lincoln Lab by using 14 hosts to simulate the external Internet environment to visit a service provider that deployed 39 hosts in the network and 6 hosts in a DMZ zone. These systems used a variety of general purpose operating systems such as Windows, Linux Red Hat 5.0, Sun OS 4.1.4 and Solaris 2.7. Both the LLDOS 1.0 and the LLDOS 2.0.2 [5] datasets contain a number of attack sessions. The experiment was conducted based on the framework of network forensics shown in Figure 1. Both LLDOS 1.0 and LLDOS 2.0.2 datasets were stored in a MySQL database that were classified by SVM. Suspicious data packets were also stored in the database in the form of event vector. Figure 6 shows the evidence graph of the initial construction of the event vector with all the nodes and edges for the evidences. Figure 5: The Evidence Graph of First Experiment Scenario. In order to use the VERA algorithm to derive the attack routes as well as the attackers, the original evidence graph is saved in an adjacency matrix which is denoted by H in the VERA algorithm. Figure 7 shows the final evidence graph for the LLDOS 1.0 dataset after running the VERA algorithm, which provides a clear and intuitive evidence of the attacker. First, the attacker derived the range of the IP addresses of the destination hosts and used host \"202.77.162.213\" to scan the entire range of the IP addresses. Second, the attacker executed \"Ping\" with the Sadmind option to check whether the Sadmind service was available in which the attacker selected host \"172.16.115.20\" as a source of the attack. Third, buffer overflow attack was launched through Sadmind vulnerability in the Solaris operating system. Fourth, the attacker acquired the root authority via Telnet and RPC to install the Mstream backdoor. Finally, the attacker used \"172.16.115.20\" to manage \"131.84.1.31\" to launch a DDoS attack whose scenario is exactly the same as that detected by the MIT Lincoln Laboratory. Figure 6: The Original Evidence Graph. (**a**) LLDOS 1.0; (**b**) LLDOS 2.0.2. Figure 7: LLDOS 1.0 Dataset Evidence Graph (Omission of DDoS Attacks). Figure 8 shows the final evidence graph for the LLDOS 2.0.2 dataset after running the VERA algorithm, which provides a rather complete attack procedure. Same as in the LLDOS 1.0 dataset scenario, the attacker carried out attacks in \"202.77.162.213\" by utilizing the Sadmins vulnerability in the Solaris OS operating system and successfully obtained the root authority on both \"172.16.112.50\" and \"172.16.115.20\". However, the attacks in the LLDOS 2.0.2 dataset were more complex and subtle. The attacker selected the \"HINFO DNS\" query to get the details of a target host (a DNS server) and compromised the DNS server via the Sadmins vulnerability in Solaris OS. Finally, the attacker uploaded attack scripts and an Mstream backdoor program to the target DNS server via FTP. To compare our method to [PERSON]'s method [3], we first show the evidence graph from [PERSON]'s work in Figure 9. To better perform the comparison, we first simplify Figure 9 and express the result in Figure 10. Comparison of Figures 7 and 10 as shown in Figure 11 clearly shows that our method can generate a more complete evidence graph. In addition, the evidence graph can show the process of attacks in more details. Although Figure 10 identifies \"172.16.112.10  
We also compared the results of running the LLDOS 2.0.2 dataset. Although it was claimed that [PERSON]'s algorithm could effectively address multi-staged attack scenarios, it is not much useful to demonstrate the attacks in the LLDOS 2.0.2 dataset.