{"id":"https://openalex.org/W7225319407","doi":"https://doi.org/10.46687/jsar.v30i1.489","title":"PASSIVE METHODS FOR NETWORK FORENSICS AND DEEP PACKET INSPECTION (DPI) IN LOCAL AREA NETWORKS","display_name":"PASSIVE METHODS FOR NETWORK FORENSICS AND DEEP PACKET INSPECTION (DPI) IN LOCAL AREA NETWORKS","publication_year":2026,"publication_date":"2026-11-05","ids":{"openalex":"https://openalex.org/W7225319407","doi":"https://doi.org/10.46687/jsar.v30i1.489"},"language":"en","primary_location":{"id":"doi:10.46687/jsar.v30i1.489","doi":"https://doi.org/10.46687/jsar.v30i1.489","is_oa":true,"landing_page_url":"https://doi.org/10.46687/jsar.v30i1.489","pdf_url":"https://jsar.ftn.shu.bg/index.php/jsar/article/download/489/485/1961","source":{"id":"https://openalex.org/S4387287558","display_name":"Journal Scientific and Applied Research","issn_l":"1314-6289","issn":["1314-6289","2815-4622"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal Scientific and Applied Research","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://jsar.ftn.shu.bg/index.php/jsar/article/download/489/485/1961","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5160737368","display_name":"Denis Zvezdelinov","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I39995536","display_name":"Shumen University","ror":"https://ror.org/03yht3k11","country_code":"BG","type":"education","lineage":["https://openalex.org/I39995536"]}],"countries":["BG"],"is_corresponding":false,"raw_author_name":"Denis Zvezdelinov","raw_affiliation_strings":["Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: d.zvezdelinov@shu.bg","institution_ids":["https://openalex.org/I39995536"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5079823610","display_name":"Zdravko Kuzmanov","orcid":"https://orcid.org/0009-0008-7233-8955","observed_orcids":["https://orcid.org/0009-0008-7233-8955"]},"institutions":[{"id":"https://openalex.org/I39995536","display_name":"Shumen University","ror":"https://ror.org/03yht3k11","country_code":"BG","type":"education","lineage":["https://openalex.org/I39995536"]}],"countries":["BG"],"is_corresponding":false,"raw_author_name":"Zdravko Kuzmanov","raw_affiliation_strings":["Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Communication and Computer Engineering and Security Technologies, Faculty of Technical Sciences, Konstantin Preslavsky University of Shumen, Shumen 9712, 115 Universitetska St., e-mail: z.kuzmanov@shu.bg","institution_ids":["https://openalex.org/I39995536"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I39995536"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"30","issue":"1","first_page":"137","last_page":"144"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/network-forensics","display_name":"network forensics","score":0.9900000095367432},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"deep packet inspection","score":0.8759999871253967},{"id":"https://openalex.org/keywords/local-area-networks","display_name":"local area networks","score":0.968999981880188},{"id":"https://openalex.org/keywords/tcpdump","display_name":"tcpdump","score":0.8460000157356262},{"id":"https://openalex.org/keywords/wireshark","display_name":"Wireshark","score":1.0},{"id":"https://openalex.org/keywords/indicators-of-compromise","display_name":"indicators of compromise","score":0.859000027179718},{"id":"https://openalex.org/keywords/file-reconstruction","display_name":"file reconstruction","score":0.7739999890327454},{"id":"https://openalex.org/keywords/digital-evidence-integrity","display_name":"digital evidence integrity","score":0.9829999804496765},{"id":"https://openalex.org/keywords/encrypted-traffic","display_name":"encrypted traffic","score":0.6470000147819519}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6725000143051147},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.6622999906539917},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6179999709129333},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.5795000195503235},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5781000256538391},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.553600013256073},{"id":"https://openalex.org/C137471899","wikidata":"https://www.wikidata.org/wiki/Q11381","display_name":"Local area network","level":2,"score":0.5040000081062317},{"id":"https://openalex.org/C50747538","wikidata":"https://www.wikidata.org/wiki/Q7001032","display_name":"Network forensics","level":3,"score":0.4943000078201294},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4796000123023987},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4480000138282776},{"id":"https://openalex.org/C2777466982","wikidata":"https://www.wikidata.org/wiki/Q5227287","display_name":"Data extraction","level":3,"score":0.4406999945640564},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.43209999799728394},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.42719998955726624},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.4027000069618225},{"id":"https://openalex.org/C95362637","wikidata":"https://www.wikidata.org/wiki/Q54366","display_name":"Packet analyzer","level":3,"score":0.3702999949455261},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3619999885559082},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.3531000018119812},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.3418999910354614},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3278999924659729},{"id":"https://openalex.org/C115051666","wikidata":"https://www.wikidata.org/wiki/Q6522493","display_name":"Ranging","level":2,"score":0.28940001130104065},{"id":"https://openalex.org/C117660856","wikidata":"https://www.wikidata.org/wiki/Q1964968","display_name":"Criminal investigation","level":2,"score":0.28760001063346863},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2721000015735626},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.27090001106262207},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C2781357168","wikidata":"https://www.wikidata.org/wiki/Q5276084","display_name":"Digital evidence","level":3,"score":0.2572999894618988},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.25200000405311584}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.46687/jsar.v30i1.489","doi":"https://doi.org/10.46687/jsar.v30i1.489","is_oa":true,"landing_page_url":"https://doi.org/10.46687/jsar.v30i1.489","pdf_url":"https://jsar.ftn.shu.bg/index.php/jsar/article/download/489/485/1961","source":{"id":"https://openalex.org/S4387287558","display_name":"Journal Scientific and Applied Research","issn_l":"1314-6289","issn":["1314-6289","2815-4622"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal Scientific and Applied Research","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.46687/jsar.v30i1.489","doi":"https://doi.org/10.46687/jsar.v30i1.489","is_oa":true,"landing_page_url":"https://doi.org/10.46687/jsar.v30i1.489","pdf_url":"https://jsar.ftn.shu.bg/index.php/jsar/article/download/489/485/1961","source":{"id":"https://openalex.org/S4387287558","display_name":"Journal Scientific and Applied Research","issn_l":"1314-6289","issn":["1314-6289","2815-4622"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal Scientific and Applied Research","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225319407.pdf","grobid_xml":"https://content.openalex.org/works/W7225319407.grobid-xml"},"referenced_works_count":1,"referenced_works":["https://openalex.org/W4417338948"],"related_works":["https://openalex.org/W4286718853","https://openalex.org/W7171326381","https://openalex.org/W3008603700","https://openalex.org/W7083624892","https://openalex.org/W1981284324","https://openalex.org/W3191861928","https://openalex.org/W2019297318","https://openalex.org/W2766474063","https://openalex.org/W2891707076","https://openalex.org/W7034696700"],"abstract_inverted_index":{"Network":[0,53],"forensics":[1],"is":[2,58,98],"a":[3],"critical":[4],"element":[5],"of":[6,22,33,43,72,78,95,105,112,114,120,133,145],"the":[7,20,31,35,41,61,69,76,92,103,110,118,131,138,142],"modern":[8],"cybersecurity":[9],"incident":[10],"investigation":[11],"process.":[12],"Unlike":[13],"active":[14],"scanning":[15],"methods,":[16],"passive":[17,44],"analysis":[18,36,97],"enables":[19],"extraction":[21,111],"evidentiary":[23],"material":[24],"without":[25,30],"modifying":[26],"network":[27],"traffic":[28],"and":[29,75,80,117,136],"risk":[32],"exposing":[34],"station.":[37],"This":[38],"report":[39,124],"examines":[40],"application":[42],"Deep":[45],"Packet":[46,66],"Inspection":[47],"(DPI)":[48],"methods":[49],"within":[50],"Local":[51],"Area":[52],"(LAN)":[54],"environments.":[55],"The":[56,123],"focus":[57],"placed":[59],"on":[60],"technological":[62],"framework":[63],"for":[64,129],"Full":[65],"Capture":[67],"(FPC),":[68],"chronological":[70],"reassembly":[71],"TCP/IP":[73],"sessions,":[74],"decoding":[77],"transport":[79],"application-layer":[81],"protocol":[82],"structures.":[83],"By":[84],"utilizing":[85],"open-source":[86],"software":[87],"tools":[88],"(tcpdump,":[89],"Wireshark,":[90],"TShark),":[91],"full":[93],"cycle":[94],"forensic":[96],"demonstrated":[99],"\u2013":[100],"ranging":[101],"from":[102,141],"generation":[104],"raw":[106],".pcap":[107],"datasets":[108],"to":[109],"Indicators":[113],"Compromise":[115],"(IoCs)":[116],"reconstruction":[119],"transferred":[121],"files.":[122],"outlines":[125],"key":[126],"methodological":[127],"recommendations":[128],"preserving":[130],"integrity":[132],"digital":[134],"evidence":[135],"analyzes":[137],"challenges":[139],"arising":[140],"widespread":[143],"adoption":[144],"encrypted":[146],"protocols":[147],"(TLS/HTTPS).":[148]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-11-06T00:00:00"}