Validation of individual identification through decision tree packet header profiling

Khairul Osman, and T'ng, Qi Feng and Hairee Izzam Mohd Noor, and Noor Hazfalinda Hamzah, and Gina Francesca Gabriel, (2022) Validation of individual identification through decision tree packet header profiling. Asia-Pacific Journal of Information Technology and Multimedia, 11 (2). pp. 97-111. ISSN 2289-2192


Official URL:


The drastic rise in the cybercrime rate associated with the surge of users' dependence on the Internet has elevated the concern of digital forensic examiners toward the footprints of perpetrators left in a virtual environment. However, suspect identification is a big challenge in network forensics due to the anonymous nature of data transmission across the network. This study utilises the decision tree classification approach to characterise users from their behavioural web navigation pattern using the meta-data of captured network packets (Destination IP, Protocol, Port Source, and Port Destination). A total of 95,795,379 network packet headers from 96 subjects were successfully collected. Their meta-data header packets were statistically profiled to generate digital fingerprints that try to link their action on the network to their identity accurately. Hence, CHAID decision tree modelling using Destination IP, Unique protocols, and a combination of the two, including Port source and Port destination, resulted in an accuracy of 4.07%, 6.34%, and 6.36%, respectively. However, the modelling could not create a reliable decision tree for the Port source and destination. The validation study on all the combined variables had a similar accuracy of 6.36%, indicating model created had reproducibility capability. Despite the outcome, the proposed method is not yet sufficiently strong for suspect identification. Further enhancement to improve its accuracy is required.

Item Type:Article
Keywords:Digital forensic; Decision tree; Digital fingerprint; User identification
Journal:Asia - Pasific Journal of Information Technology and Multimedia (Formerly Jurnal Teknologi Maklumat dan Multimedia)
ID Code:20851
Deposited By: ms aida -
Deposited On:16 Dec 2022 01:10
Last Modified:21 Dec 2022 08:29

Repository Staff Only: item control page