A Hybrid Traceback based Network Forensic Technique to Identifying Origin of Cybercrime

Protecting the critical infrastructure is crucial task when the cybercrime and cyber-threats are on the rise. The internet is vulnerable to packet tampering, as it does not have any safeguards in place. While initiating an attack, attackers use vulnerabilities to alter the source IP address. As a result, cybercrime investigations are becoming increasingly challenging. The network is the backbone of cybercrime, and it is important to develop a network forensic investigation system to determine the true origin of cybercrime. The purpose of this study is to propose a hybrid source identification system for network forensic investigations, which could identify the source of the attack with a single packet with minimal computational capacity and high storage. The CAIDA topology database estimates that each route requires just 320KB of storage. Finally, we simulate and compare our system to other similar systems in terms of storage requirements, processing, and logging time.