Embed Size (px)
Citation preview
Crime Investigation with KNIME
Crime Investigation with KNIMECardsharing at Pay TV
Crime Investigation with KNIME
Pay TV - a short description
Digital Video Broadcast Reveiver
CSA – Common Scrambling AlgorithmEMM – Entitlement Management MessageECM – Entitlement Control MessageCW – Control Word
Crime Investigation with KNIME
Card sharing – computer fraud
Digital Video Broadcast
User
Card-Sharing
Crime Investigation with KNIME
Server – Client Network
Crime Investigation with KNIME
Fruchterman-Reingold
Crime Investigation with KNIME
pcap analysis
One of the Question from the public prosecutor:Which german users connected the card-sharing-server
over a period of 300 seconds (5 minutes) in the time from 20 o'clock the day before yesterday und 20 o'clock yesterday?
Raw Data:● Combined wiretap from 3 card-sharing-server● wiretap period over 3 month● about 60 files (500 MByte) per day● about 17 Mio. packets per file● about 125.000 connections per file
Crime Investigation with KNIME
Full KNIME workflow
Crime Investigation with KNIME
Wireshark summary
Crime Investigation with KNIME
TCP-Flow
Crime Investigation with KNIME
Select files from period
Crime Investigation with KNIME
Load files ...
Crime Investigation with KNIME
split xml-files
Crime Investigation with KNIME
join server and client communication
Crime Investigation with KNIME
period time from 20 to 20
Crime Investigation with KNIME
prepare data from geolocation
Crime Investigation with KNIME
ip-address geolocation
Crime Investigation with KNIME
German only, time diff and group by
Crime Investigation with KNIME
whois and save
Crime Investigation with KNIME
csv – file with localized German users
Crime Investigation with KNIME
Full workflow
Automatisation of the analysis process. Using a cronjob.● Download of the witetap-files from ftp-server
[all 4 hours]● Start of the analysis process at 4 o'clock every day
● Cut the generic routing encapsulation (editcap)● Flow analysis to get the server-client connections within 6
consecutive pcap-files (tcpflow)– KNIME workflow to generate csv-tables with German IP-
addresses (KNIME batch-mode)● Encryption of the created csv-files (gpg)● Sending the encrypted files to the investigation
department at about 10 o'clock
Crime Investigation with KNIME
Questions ?
Andreas StahlhutPolice Department ZKD HannoverCybercrime Investigation [email protected]
