A method for forensic artefact collection, analysis and incident response in environments running session initiation protocol and session description protocol. (17th November 2014)

• Record Type: Journal Article
• Authors: Psaroudakis, Ioannis; Katos, Vasilios; Saragiotis, Panagiotis; Mitrou, Lilian
• Is Part Of: International journal of electronic security and digital forensics. Volume 6:Number 4(2014)
• Page Start: 241
• Page End: 267
• Publication Date: 2014-11-17
• Subjects: network forensics -- session initiation protocol -- SIP -- VoIP forensics -- intrusion detection systems -- IDSs -- network logging; Computer crimes -- Periodicals; Computer crimes -- Investigation -- Periodicals; Computer security -- Periodicals; Electronic commerce -- Law and legislation -- Periodicals; Information warfare -- Periodicals; 005.805
• Languages: English
• ISSNs: 1751-911X

Abstract

In this paper, we perform an analysis of SIP, a popular voice over IP (VoIP) protocol and propose a framework for capturing and analysing volatile VoIP data in order to determine forensic readiness requirements for effectively identifying an attacker. The analysis was performed on real attack data and the findings were encouraging. It seems that if appropriate forensic readiness processes and controls are in place, a wealth of evidence can be obtained. The type of the end user equipment of the internal users, the private IP, the software that is used can help build a reliable baseline information database. On the other hand the private IP addresses of the potential attacker even during the presence of NAT services, as well as and the attack tools employed by the malicious parties are logged for further analysis.