6th European Conference - Academic Conferences

Figure 2: CALEA forensic model (Pelaez 2007)
Jose Mas y Rubi et al.
Telephone interception can be classified in two categories:
Call detail: Send and receive call details from a subscriber, that will pass to LEA. The generated call
registration created from signaling message can be very valuable in criminal investigations. The
signaling message contains data from phone calls, not about the content of the conversation.
Therefore, the recollection and analysis of signaling messages cannot be subject to the same legal
restrictions as recording voice conversations (Moore 2005).
Call content: It is the real content of the call that we pass to LEA. The suspect must not detect the
mirror, so this element must be produced inside the network and not in the subscriber link. Also this
mirror must not be detectable by any change in time, availability characteristics or operation (Pelaez
2007).
In order that LEA take advantage of the call content without the subscriber knowledge of any change,
all the calls must pass through a device that duplicate the content and then pass it to the agency
(Pelaez 2007).
3.2 REN–JIN model
This model, conceived by Wei Ren and Hai Jin, is designed to capture the network traffic and to
register the corresponding data. This network forensic system has 4 elements (Pelaez 2006):
Network Forensics Server, which integrates the forensic data and analyzes it. It also guides the
network packet filter and captures the behavior of the Network Monitor. It can request the
activation of an investigation program in the Network Investigator has an answer to a sensitive
attack.
Network Forensics Agents, is responsible of data recollection, data extraction and data secure
transportation. These agents are distributed around the network and the monitored hosts.
Network Monitor, is a packet and network traffic capture machine.
Network Investigator, is the network surveillance machine. It investigates a target when the server
gives the command. It activates a real time response program for each network intrusion.
The forensic network and Honeynet systems have the same data recollection function for system
misuse. A Honeynet system lures attackers and gains information about new types of intrusions.
Network forensic system analyzes and reconstructs the attack behavior. The integration of both
systems will help to create an active self-learning and response system to capture the intrusion
behavior and investigate the attack original source (Pelaez 2006).
163