# Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning
## 3 The Proposed Method
### Data Standardization
#### 3.2.2 Support Vector Machine (SVM)  
Machine learning techniques are widely used in data mining in general and network traffic analysis in particular. Support vector machine (SVM) [28] is one of the most popular supervised learning algorithms for both regression and classification problems due to its robustness and high accuracy. SVM is capable of accurately classifying network traffic through using a small set of training samples, making it an effective tool to perform network packet classification. We will use the widely popular open source SVM code LIBSVM [29] in our experiments to separate suspicious packets from all other packets. This is because the large percentage of redundancy that exists in network packets would make it difficult to analyze attacks in an efficient manner. We thus use SVM to filter out benign packets and suspicious packets and then use the suspicious packets to construct an accurate evidence graph. The use of the LIBSVM generally involves two steps: first, training a data set to obtain a model and second, using the model to predict information of a testing data set. We adopt the data that was acquired from the 1998 DARPA intrusion detection evaluation program which is blasted with multiple attacks in a local area network (LAN) that simulated a typical U.S. Air Force LAN. For each TCP/IP connection, 41 various quantitative and qualitative features (KDD-CUP-99 [30] Task Description) were extracted. We partition the packets into two classes: normal and attack, where the attack packets consist of the collection of all 22 different attacks. In the experiment, all attack packets are classified and labeled as +1 and normal data as \(-1\). We use a training set of 7312 data items with 41 features. The data set contains benign packets and suspicious packets. First, we transform each and every packet into a matrix that consists of 41 features and a class flag as shown in the following example records: \begin{tabular}{|l|} \hline _duration, protocol_type, service, flag, src_bytes, dst_bytes, land, wrong_fragment, urgent, hot,_ \\ _num_failed_logins, Logged in, num_compromised, root_shell, SU_attempted, num_root, num_file_creations,_ \\ _num_shells, num_access_files, num_outbound_cmds, is_hot_login, is_guest_login, count, server_rate,_ \\ _error_rate, same_srv_rate, diff_srv_rate, strv_count, str_server_rate, strv_error_rate, strv_diff_host_rate,_ \\ _dst_host_count, dst_host_srv_count, dst_host_same_src_rate, dst_host_diff_srv_rate,_ \\ _dst_host_same_src_port_rate, dst_host_srv_diff_host_rate, dst_host_server_rate, dst_host_server_rate, \\ _dst_host_server_rate, dst_host_src_error_rate, dst_host_server_rate, \\ _0,tcp_http,SF,210,151,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1.00,0,0,0,0,0,0,0,0,8,9,1.00,0,0,0,0,12,0,0.04,0.00,0.00,0.00,0.00 \\ \end{tabular}   
_0,tcp_http,SF,212,786,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,99,1.0,0,0,0,0,12,0.05,0.00,0.00,0.00,0.00 \\ \end{tabular}  
All packets are transformed into the above format and are then stored in a matrix named \"data\" as the training data. Then, we place the class tag (1 or \(-1\)) in a \"label\" variable. The \"data\" matrix is an attribute matrix where the number of rows and columns are determined by the number of samples and the number of attributes, respectively. The \"label\" variable is a class tag (1 or \(-1\)). Lastly, we use LIBSVM to build a classification model which we have used to test 6980 data items with 41 features. The method of processing the test data is the same as the above and Table 1 lists the results while Figure 2 shows the ROC curve. Network packet classification would filter out suspicious packets from a dataset and the result will be stored in the form of the event vector. With data standardization, we can use standardized data to construct an evidence graph. SVM is used to filter out benign packets and suspicious packets so as to construct a more accurate evidence graph using the suspicious packets.