Hviz: HTTP(S) traffic aggregation and visualization for network forensics
| Autor: | Bernhard Ager, Vincent Lenders, Fabian Gasser, David Gugelmann |
|---|---|
| Přispěvatelé: | Roussev, Vassil |
| Jazyk: | angličtina |
| Rok vydání: | 2015 |
| Předmět: |
Network forensics
Event reconstruction Computer science Event (computing) Incident investigation HTTP(S) Aggregation Visualization Timeline computer.software_genre Computer security Computer Science Applications World Wide Web Medical Laboratory Technology Campus network Web page Malware Law Interactive visualization computer |
| Zdroj: | Digital Investigation, 12 (Supplement 1) Proceedings of the Second Annual DFRWS Europe |
| ISSN: | 1742-2876 1873-202X |
| Popis: | HTTP and HTTPS traffic recorded at the perimeter of an organization is an exhaustive data source for the forensic investigation of security incidents. However, due to the nested nature of today's Web page structures, it is a huge manual effort to tell apart benign traffic caused by regular user browsing from malicious traffic that relates to malware or insider threats. We present Hviz, an interactive visualization approach to represent the event timeline of HTTP and HTTPS activities of a workstation in a comprehensible manner. Hviz facilitates incident investigation by structuring, aggregating, and correlating HTTP events between workstations in order to reduce the number of events that are exposed to an investigator while preserving the big picture. We have implemented a prototype system and have used it to evaluate its utility using synthetic and real-world HTTP traces from a campus network. Our results show that Hviz is able to significantly reduce the number of user browsing events that need to be exposed to an investigator by distilling the structural properties of HTTP traffic, thus simplifying the examination of malicious activities that arise from malware traffic or insider threats. Digital Investigation, 12 (Supplement 1) ISSN:1742-2876 ISSN:1873-202X Proceedings of the Second Annual DFRWS Europe |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect