Análise forense em tráfego de redes corporativas

Abstract

Network forensics is a sub-branch of digital forensics which leads an investigative process involving active networks, as well as your traffic. Currently, due to increasing demand for multi-services platforms to meet the needs of the business organizations, the events associated with anomalies in network traffic also grew, requiring specific investigative strategies to detect them and determine his authorship. Therefore, forensic network can be seen as the action of the security analyst aimed at data collection related to security incidents for subsequent analysis and survey evidences which could provide support for the completion of certain fact. Forensic network complements the answers to information security incident and can be characterized as the second step of this process. This paper aims to introduce the concepts, techniques and procedures that involve investigative activities in corporate network environments.