A Framework for Digital Investigation of Peer-to-Peer (P2P) Networks. An Investigation into the Security Challenges and Vulnerabilities of Peer-to-Peer Networks and the Design of a Standard Validated Digital Forensic Model for Network Investigations

Abstract

Peer-to-Peer (P2P) Networks have been presenting many fascinating capabilities to the internet since their inception, which has made and is still gathering so much interest. As a result, it is being used in many domains, particularly in transferring a large amount of data, which is essential for modern computing needs. A P2P network contains many independent nodes to form a highly distributed system. These nodes are used to exchange all kinds of files without using a single server as in a Client-Server architecture. Such types of files make the network highly vulnerable to malicious attackers. Nevertheless, P2P systems have become susceptible to different malicious attacks due to their widespread usage, including the threat of sharing malware and other dangerous programs, which can be significantly damaging and harmful. A significant obstacle with the current P2P network traffic monitoring and analysis involves many newly emerging P2P architectures possessing more intricate communication structures and traffic patterns than the traditional client-server architectures. The traffic volume generated by these networks, such as uTorrent, Gnutella, Ares, etc., was once well over half of the total internet traffic. The dynamic use of port numbers, multiple sessions, and other smart features of these applications complicate the characterization of current P2P traffic. Transport-level traffic identification is a preliminary but required step towards traffic characterization, which this thesis addresses. Therefore, a novel detection mechanism that relies on transport-level traffic characterization has been presented for P2P network investigation The importance of the investigation necessitates the formalization of frameworks to leverage the integration of forensics standards and accuracy to provide integrity to P2P networks. We employed the standard Analysis, Design, Development, Implementation, and Evaluation (ADDIE) model to aid a credible digital investigation. We considered the ADDIE model for validation as a standard digital forensic model for P2P network investigations using the United States’ Daubert Standard, the United Kingdom's Forensic Science Regulator Guidance – 218 (FSR-G-218), and Forensic Science Regulator Guidance – 201 (FSR-G-201) methodologies. The solution was evaluated using a realistic P2P investigation and showed accurate load distribution and reliable digital evidence.