The Design of Network Forensics Based on Jpcap

Abstract

The massive data must be captured and transferred in network forensics, Jpcap has provided convenient method for capturing and transferring network data. After capturing and filtering the network data packet, network forensics based on Jpcap analyzes protocol to primary data, and the current user behavior is judged legal or not through match results of user behavior and the crime characteristic. In order to guarantee evidence primitiveness, integrity and legal efficiency, the primary data is transferred by encryption. Simulation results show that the system can reappear the criminality completely, such as SYN flood and ARP deception, and can distinguish some new crimes.