Scribd
Upload
20 views21 pages

Network Forensic

The document presents an overview of network forensics, detailing its importance in cybersecurity for detecting and responding to cyber threats. It outlines the steps involved in network forensic examinations, including identification, preservation, collection, examination, analysis, presentation, and incident response. The conclusion emphasizes the role of network forensics in uncovering malicious activities and enhancing organizational defenses.

Uploaded by

minyekhine007
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
20 views21 pages

Network Forensic

The document presents an overview of network forensics, detailing its importance in cybersecurity for detecting and responding to cyber threats. It outlines the steps involved in network forensic examinations, including identification, preservation, collection, examination, analysis, presentation, and incident response. The conclusion emphasizes the role of network forensics in uncovering malicious activities and enhancing organizational defenses.

Uploaded by

minyekhine007
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 21

Network Forensic

Presented by Group(X)
Group Members

Ma Nyein Htet Htet Kyaw IXCS-11

Ma Ei Cho That IXCS-18

Ma Tin Su Pyae Zan IXCS-37

Ma Chit Su Maung IXCS-44

Mg Min Ye Khine IXCS-56


Contents
Introduction

Network Forensic
examination steps

Conclusion
Introduction
• Network forensics is categorized as a single branch of digital form.
• It includes the areas of monitoring and analyzing computer net and
allows individuals to gather information, compile evidence, detect
intrusions.
Network Forensic examination steps

1.Identification 2.Preservation 3.Collection

4.Examination 5.Analysis 6.Presentation

7.Incident Response
1. Identification

Recognizing and determining an incident based on netwc indicators. This


step is significant since it has an impact in the following.
Key Aspects of Identification in Network Forensics

1.Traffic Monitoring – Observing and recording network packets to


detect anomalies or suspicious behavior.

2.Anomaly Detection – Using intrusion detection systems (IDS) and


security information and event management (SIEM) tools to identify
irregularities.

3.Log Analysis – Reviewing logs from firewalls, routers, and servers


to find signs of compromise.
2.Preservation

Securing and isolating the state of physical and logical evi from being
altered, such as, for example, protection from electromagnetic damage or
interference.
Key Aspects of Preservation in Network Forensics

1.Data Integrity – Ensuring that collected network logs, packets,


and forensic artifacts are not modified or tampered with.

2.Chain of Custody – Maintaining a detailed record of how


evidence is collected, stored, and accessed to ensure its credibility
in legal cases.

3.Secure Storage – Using encrypted, access-controlled storage


systems to protect forensic data from unauthorized access.
3.Collection

Recording the physical scene and duplicating digital


eviden standardized methods and procedures.
Key Aspects of Collection in Network Forensics

1.Packet Capture (PCAP) – Recording network traffic in real-time using


tools like Wireshark or tcpdump.

2.Log Collection – Gathering logs from firewalls, routers, intrusion


detection systems (IDS), and servers to analyze network activities.

3.Metadata Extraction – Collecting metadata such as IP addresses,


timestamps, and communication patterns.
4.Examination
In-depth systematic search of evidence relating to the netw attack. This
focuses on identifying and discovering potential evidence and building
detailed documentation for analysis.
Key Aspects of Examination in Network Forensics

1.Data Filtering & Sorting – Organizing captured network packets


and logs to focus on relevant data.

2.Log Analysis – Examining firewall, system, and intrusion detection


logs for suspicious activities.

3.Pattern Recognition – Identifying attack signatures, unusual


behaviors, and indicators of compromise (IOCs).
5.Analysis

Determine significance, reconstruct packets of network traffic


data and draw conclusions based on evidence found.
Key Aspects of Analysis in Network Forensics

1.Anomaly Detection – Identifying deviations from normal


network behavior that may indicate a cyberattack.

2.Threat Attribution – Determining the source, method, and


intent of an attack by analyzing network patterns.

3.Correlation of Events – Linking different network activities to


reconstruct the sequence of an attack.
6. Presentation
Summarize and provide explanation of drawn conclusions.
Key Aspects of Presentation in Network Forensics

1.Report Documentation – Creating a structured forensic report


that includes key findings, evidence, and timelines.

2.Visual Representation – Using charts, graphs, and network


diagrams to illustrate attack patterns and incident impact.

3.Technical and Non-Technical Explanation – Presenting


findings in a way that is understandable for both cybersecurity
experts and non-technical audiences.
7. Incident Response

The response to attack or intrusion detected is initiated based on the


information gathered to validate and assess the incident.
Key Aspects of Incident Response in Network Forensics

1.Detection & Identification – Monitoring network activity to identify


suspicious behavior and security breaches.

2.Evidence Collection – Capturing network logs, packet data, and system


artifacts for forensic analysis.

3.Analysis & Investigation – Examining collected data to determine the


attack method, origin, and impact.
Conclusion
Network forensics plays a crucial role in cybersecurity by helping
organizations detect, investigate, and respond to cyber threats. Through
the systematic collection, examination, and analysis of network data,
security teams can uncover malicious activities, track attackers, and
strengthen defenses against future incidents.
Thank You

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy