Existing network security mechanisms examine application headers and payloads of packet flows against signature databases. Such practices are known as deep packet inspection. If matched, the packets are blocked and logged. These mechanisms are stateless since they detect and log the concerned events but could not reproduce the events, i.e. only detection but no forensics. On the contrary, if the traffic of an event, i.e. the states, can be recorded and later reproduced to do forensics, we have the chance to push the current stateless network security, named as security 1.0, to the next-generation stateful network security, named as security 2.0, which appears to be a sound vision to pursue. The states could be recorded continuously on all traffic or only piece-wisely on specific events. Apparently the continuous recording would have traffic volume explosion and difficulties to search for specific events. Thus, the piece-wise recording is a better model, though it requires some non-trivial extraction of specific events by either real-time on-line detection of these events from the raw traffic or non-real-time off-line extraction from the recorded traffic.

     This 3-year project aims, by leveraging the beta site with real live traffic managed by the NCTU Computer Center (CC) and Network Benchmarking Lab (NBL), to develop and test a piece-wise stateful network forensics system which calls for research on 4 forensics techniques and 3 forensics applications. The 4 techniques include traffic capture and replay, application classification, extraction of concerned traffic, and multi-point forensics, while the 3 applications are a fully integrated piece-wise stateful network forensics system, named as soft real-time network forensics system, bug reproduction, and libraries of PCAP files. In the 1st year, we intend to complete the 1Gbps-Ethernet version of the first three forensics techniques. In the 2nd year, we extend to the multi-point forensics and the three forensics applications. These 1Gbps-Ethernet solutions are to be upgraded to their 10Gbps-Ethernet version in the 3rd year.