Learning Network Forensics