In criminal investigations, telecommunication wiretaps have become a common technique used by law enforcement. While phone-based wiretapping is well documented and the procedure for their execution are well known, the same cannot be said for Internet taps. Lawfully intercepted network traffic often contains a lot of encrypted traffic making it increasingly difficult to find useful information inside the traffic captured. The advent of Internet-of-Things further complicates the process for non-technical investigators. The current level of complexity of intercepted network traffic is close to a point where data cannot be analysed without supervision of a digital investigator with advanced network knowledge. Current investigations focus on analysing all traffic in a chronological manner and are predominately conducted on the data contents of the intercepted traffic. This approach often becomes overly arduous when the amount of data to be analysed becomes very large. In this paper, we propose a novel approach to analyse large amounts of intercepted network traffic based on network metadata. Our approach significantly reduces the duration of the analysis and also produces an insight view of analysing results for the non-technical investigator. We also test our approach with a large sample of network traffic data.


    Access

    Download


    Export, share and cite



    Title :

    Network Intell: Enabling the Non-Expert Analysis of Large Volumes of Intercepted Network Traffic


    Contributors:

    Publication date :

    2017


    Type of media :

    Preprint


    Type of material :

    Electronic Resource


    Language :

    English




    Estimating missing link volumes in a traffic network

    Van Der Zijpp, N. J. / De Kort, A. / European Transport Forum | British Library Conference Proceedings | 1997


    60-degree intercepted track calculation method

    CAO ZHI / QI MINGDONG / ZHANG HENG et al. | European Patent Office | 2024

    Free access

    Triggered and Intercepted Lightning Arcs on Aircraft

    Boulay, J. | British Library Conference Proceedings | 1996


    Examination of Methods That Adjust Observed Traffic Volumes on a Network

    Kikuchi, Shinya / Miljkovic, Dragana / van Zuylen, Henk J. | Transportation Research Record | 2000


    Examination of Methods That Adjust Observed Traffic Volumes on a Network

    Kikuchi, S. / Miljkovic, D. / van Zuylen, H. J. et al. | British Library Conference Proceedings | 2000