Design of a logical traffic isolation forensic model

Abstract

Currently, network evidence used in a court of law can be lacking and inadequate for prosecution purposes, due to a loss of packets during the network transmission. This packet loss in turn may be caused by the congestion of data transmitted over the network, further delaying the transmitted data. This paper extends the work on a forensic model for traffic isolation based on Differentiated Services (DiffServ). This model intends to solve the packet loss problem that can result to insufficient evidence. It isolates suspicious traffic from the normal flow by placing it on the dedicated route using DiffServ prioritising characteristics. This avoids traffic congestion of the suspicious traffic. The LTI model further includes the preservation station which serves to record all suspicious traffic before it is forwarded to its destination. This paper looks at the analysis and design of the logical traffic isolation model using various UML design artefacts. By incorporating various design algorithms, this paper aims at designing the more flexible and reliable system, with a minimal loss of evidence.