Network forensics is a separate large area of Computer Forensics. It also includes various fields. Under network forensics, we should understand forensics where the main evidence is researched digital network traffic logs of network equipment, network applications, such as proxies, firewalls, servers, and so on.
Together with a conventional host-based network, forensics allows us to resolve the incident more efficiently. Information from the network layer provides a complete picture of what happened. Moreover, in some cases the analyst does not have access to these compromised machines because attackers use encryption, delete files, or use other techniques to hide information.
In cases of complex targeted attacks, initial network intrusion is only the first stage of an attack. The next steps for the promotion of the network, the development of the attack, the collection of information, and data exfiltration occur with the use of the network.
Network traffic data...