A Distributed Framework for Forensics Based on the Content of Network Transmission

A distributed framework for network forensics is presented in this paper, which tries to capture and store the digital evidence of the information leaking through the network. The architecture of the frame work is composed of the distributed data agents and the forensic center. The former can extract and compress the text of the content of all target network transmission, and the latter can locate the address of the host which illegally transmitted classified or improper information in the network, based on the evidence data gathered from the data agents. The time of the data being stored is longer than a year with the high compression ratio of the text, so the user can confirm the events of the information leaking that happened fairly long time ago.