6th European Conference - Academic Conferences

Figure 3: REN-JIN forensic model (Pelaez 2006)
Jose Mas y Rubi et al.
The Honeynets are highly controlled type of network architecture, one in which you can monitor all
activity that occurs. By placing real victims (which can be any type of system, service or information)
inside the network like an attack target, it creates an environment where you can observe everything
that happens on it, allowing the attacking intruders interact with the Honeynet while information from
that attack is being collected. This happens because Honeynets are high interaction real networks
which implement traps to detect, deviate, or in some cases, to counteract non-authorize uses of the
information system; where no service neither traffic is generated. Therefore, any interaction with the
Honeynet implies malicious or non-authorize activities. Any connection initiated to a Honeynet implies
that someone has compromised a system and has initiated a suspicious activity. This makes much
easier the activity analysis, because all the captured information can be assumed as non-authorize or
malicious one (Honeynet 2006).
4. Comparative analysis
One of the objectives of our work is to discuss the structure of REN-JIN and CALEA models, so that
at the end, we could affirm if one of these models can be applicable for a VoIP traffic forensic
analysis, and also proposing possible improvement to the selected model in this analysis process.
The methodology to follow implies that the mentioned models are analyzed in the DFRWS general
model structure, to identify if all the elements functions of each individual model meet the
requirements of the chosen general model.
In conclusion, the elements that integrate the forensic models CALEA and REN-JIN will be located in
the corresponding step of the DFRWS model structure, to identify if the functions that those elements
provide can cover one of the general model’s important steps.
4.1 Discussion and analysis
Table 2 shows the main function of each of the analyzed models, and then compared to the general
model functions:
4.2 REN-JIN and CALEA operation differences
The main functions of CALEA are focused on a single component, LEA, which will depend on the
traffic mirror used by the forensic agents to collect the required information. This makes the model
easily adaptable to the rules governing the legal interception in the countries where these type of tools
are used. However, it is the duty of each country to lay down rules for the use of this type of system,
so the collected evidence could have full legality in the judicial environment.
164