NDLI: Device Tracking in Private Networks via NAPT Log Analysis

Content Provider	IEEE Xplore Digital Library
Author	Castiglione, A. De Santis, A. Fiore, U. Palmieri, F.
Copyright Year	2012
Abstract	The source IP address where an offending activity had originated is of limited value because it does not specify a physical location, but an endpoint in a network for the sole purpose of routing. In addition, people and their devices move across the network, changing IP address as a consequence. It is useful to have some clues about where a device was at the time the offending action was performed. However, it would be desirable to correlate different pieces of evidence to discover other information, such as IP addresses used by the same device. Devices repeatedly accessing a private network, at different times, can be profiled by analyzing and correlating Network and Port Address Translation (NAPT) logs, in order to recognize recurring activity patterns. By mapping sequences of NAPT translations into multi-dimensional curves and computing a similarity measure on these, it is possible to group multiple different curves into common sets or profiles, that can be ascribed to individual users/machines. In this way, it is possible to recognize some of the users from their traffic peculiarities (browsing habits, mail access, network traffic generated by specific applications, etc.) without considering the exposed IP addresses. Experiments were performed on NAPT logs gathered in a campus network, with DHCP data providing control values for validation.
Starting Page	603
Ending Page	608
File Size	177515
Page Count	6
File Format	PDF
ISBN	9781467313285
DOI	10.1109/IMIS.2012.125
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-07-04
Publisher Place	Italy
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Performance evaluation Protocols IP Networks Forensics Similarity Matching Network Investigation Log Analysis Device Tracking Digital Forensics Network Address Translation Network Forensics Internet IP networks Payloads
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Modular components for network address translation

Automatic VPN client recovery from IPsec pass-through failures

Economically managing multiple private data networks

Characterizing network processing delay

SIP/RTP session analysis and tracking for VoIP logging

Mobile IP using private IP address through stateful network address translation

Inferring the extent of network address port translation at public/private internet boundaries (2002)

An application of network address translation on gateway

Network address translators: effects on security protocols and applications in the TCP/IP stack

Device Tracking in Private Networks via NAPT Log Analysis

Similar Documents

Modular components for network address translation

Automatic VPN client recovery from IPsec pass-through failures

Economically managing multiple private data networks

Characterizing network processing delay

SIP/RTP session analysis and tracking for VoIP logging

Mobile IP using private IP address through stateful network address translation

Inferring the extent of network address port translation at public/private internet boundaries (2002)

An application of network address translation on gateway

Network address translators: effects on security protocols and applications in the TCP/IP stack

Device Tracking in Private Networks via NAPT Log Analysis