A framework for digital forensics of encrypted real-time network traffic, instant messaging, and VoIP application case study
Soliman Abd Elmonsef Sarhan, Hassan Youness, Ayman M. Bahaa-Eldin
Abstract
Digital forensics is one of the prime professional fields for law enforcement forces. It is also a major active research topic in the cybersecurity field. Internet traffic and content analysis are leading tasks within this research area. Most of the internet traffic is now encrypted, making the traditional analysis of contents impossible. In this paper, we proposed a novel framework and methodology to extract a valuable set of information from encrypted traffic of Instant Messages and Voice Over IP applications. The presented framework enables the analysts to detect, classify and analyze encrypted traffic (typing, chatting, media transmission of audio and video calls, etc.). The provided framework was tested by taking over 30 trace files of these activities and looking at some specific payload patterns. The proposed methodology's results enable investigators to detect and extract application user behavior that can be used as evidence for a forensics investigation. Also, it shows that a valuable set of information can be extracted from encrypted WhatsApp and Telegram traffic.