{"id":"https://openalex.org/W3162398026","doi":"https://doi.org/10.1109/ntms49979.2021.9432677","title":"WhatsApp Network Forensics: Discovering the IP Addresses of Suspects","display_name":"WhatsApp Network Forensics: Discovering the IP Addresses of Suspects","publication_year":2021,"publication_date":"2021-04-19","ids":{"openalex":"https://openalex.org/W3162398026","doi":"https://doi.org/10.1109/ntms49979.2021.9432677","mag":"3162398026"},"language":"en","primary_location":{"id":"doi:10.1109/ntms49979.2021.9432677","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ntms49979.2021.9432677","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 11th IFIP International Conference on New Technologies, Mobility and Security (NTMS)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5014328365","display_name":"Waqas Ahmed","orcid":"https://orcid.org/0000-0002-3809-1089"},"institutions":[{"id":"https://openalex.org/I899713450","display_name":"Air University","ror":"https://ror.org/03yfe9v83","country_code":"PK","type":"education","lineage":["https://openalex.org/I899713450"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Waqas Ahmed","raw_affiliation_strings":["National Center for Cyber Security, Air University, Islamabad, Pakistan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Center for Cyber Security, Air University, Islamabad, Pakistan","institution_ids":["https://openalex.org/I899713450"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004916379","display_name":"Faisal Shahzad","orcid":"https://orcid.org/0000-0003-3891-9189"},"institutions":[{"id":"https://openalex.org/I899713450","display_name":"Air University","ror":"https://ror.org/03yfe9v83","country_code":"PK","type":"education","lineage":["https://openalex.org/I899713450"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Faisal Shahzad","raw_affiliation_strings":["National Center for Cyber Security, Air University, Islamabad, Pakistan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Center for Cyber Security, Air University, Islamabad, Pakistan","institution_ids":["https://openalex.org/I899713450"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069580698","display_name":"Abdul Rehman Javed","orcid":"https://orcid.org/0000-0002-0570-1813"},"institutions":[{"id":"https://openalex.org/I899713450","display_name":"Air University","ror":"https://ror.org/03yfe9v83","country_code":"PK","type":"education","lineage":["https://openalex.org/I899713450"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Abdul Rehman Javed","raw_affiliation_strings":["Air University, Islamabad, Pakistan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air University, Islamabad, Pakistan","institution_ids":["https://openalex.org/I899713450"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068447696","display_name":"Farkhund Iqbal","orcid":"https://orcid.org/0000-0001-9081-3598"},"institutions":[{"id":"https://openalex.org/I91044093","display_name":"Zayed University","ror":"https://ror.org/03snqfa66","country_code":"AE","type":"education","lineage":["https://openalex.org/I91044093"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Farkhund Iqbal","raw_affiliation_strings":["College of Technological Innovation, Zayed University, United Arab Emirates"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Technological Innovation, Zayed University, United Arab Emirates","institution_ids":["https://openalex.org/I91044093"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5108263231","display_name":"Liaqat Ali","orcid":null},"institutions":[{"id":"https://openalex.org/I899713450","display_name":"Air University","ror":"https://ror.org/03yfe9v83","country_code":"PK","type":"education","lineage":["https://openalex.org/I899713450"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Liaqat Ali","raw_affiliation_strings":["Air University, Islamabad, Pakistan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Air University, Islamabad, Pakistan","institution_ids":["https://openalex.org/I899713450"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.3379,"has_fulltext":false,"cited_by_count":35,"citation_normalized_percentile":{"value":0.95154936,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.836087167263031},{"id":"https://openalex.org/keywords/network-forensics","display_name":"Network forensics","score":0.791512131690979},{"id":"https://openalex.org/keywords/law-enforcement","display_name":"Law enforcement","score":0.6066866517066956},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.5349401831626892},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5333879590034485},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.507227897644043},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.49268752336502075},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4723200500011444},{"id":"https://openalex.org/keywords/instant-messaging","display_name":"Instant messaging","score":0.45749861001968384},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.4281967580318451},{"id":"https://openalex.org/keywords/mobile-phone","display_name":"Mobile phone","score":0.42268335819244385},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3160412013530731},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.26136261224746704},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.12400677800178528}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.836087167263031},{"id":"https://openalex.org/C50747538","wikidata":"https://www.wikidata.org/wiki/Q7001032","display_name":"Network forensics","level":3,"score":0.791512131690979},{"id":"https://openalex.org/C2780262971","wikidata":"https://www.wikidata.org/wiki/Q44554","display_name":"Law enforcement","level":2,"score":0.6066866517066956},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.5349401831626892},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5333879590034485},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.507227897644043},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.49268752336502075},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4723200500011444},{"id":"https://openalex.org/C2985487447","wikidata":"https://www.wikidata.org/wiki/Q58199","display_name":"Instant messaging","level":2,"score":0.45749861001968384},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.4281967580318451},{"id":"https://openalex.org/C2777421447","wikidata":"https://www.wikidata.org/wiki/Q17517","display_name":"Mobile phone","level":2,"score":0.42268335819244385},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3160412013530731},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.26136261224746704},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.12400677800178528},{"id":"https://openalex.org/C187736073","wikidata":"https://www.wikidata.org/wiki/Q2920921","display_name":"Management","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ntms49979.2021.9432677","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ntms49979.2021.9432677","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 11th IFIP International Conference on New Technologies, Mobility and Security (NTMS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7400000095367432}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W1534992827","https://openalex.org/W1899307735","https://openalex.org/W2011473359","https://openalex.org/W2155877710","https://openalex.org/W2344466211","https://openalex.org/W2557842949","https://openalex.org/W2611632074","https://openalex.org/W2960363987","https://openalex.org/W3005923092","https://openalex.org/W3006449446","https://openalex.org/W3012823428","https://openalex.org/W3042687732","https://openalex.org/W3094117827","https://openalex.org/W3121960994","https://openalex.org/W3128222028","https://openalex.org/W6736800014","https://openalex.org/W6780522411","https://openalex.org/W6788509728"],"related_works":["https://openalex.org/W2036903135","https://openalex.org/W2347635077","https://openalex.org/W4286718853","https://openalex.org/W2393143026","https://openalex.org/W2365578302","https://openalex.org/W2258115363","https://openalex.org/W2294488712","https://openalex.org/W2317800487","https://openalex.org/W4220783909","https://openalex.org/W2031955211"],"abstract_inverted_index":{"Call":[0],"record":[1],"analysis":[2],"is":[3,77,99,124],"the":[4,9,23,31,44,63,83,102,106,128,133,142,152,157],"most":[5,74,129],"critical":[6],"task":[7],"for":[8,57,62,121,126],"Law":[10],"Enforcement":[11],"Agencies":[12],"(LEAs)":[13],"in":[14,22,148],"a":[15,87],"cyber-investigation":[16],"process.":[17],"It":[18],"provides":[19],"valuable":[20],"information":[21,81],"investigation,":[24],"such":[25,91],"as":[26,92],"time":[27],"and":[28,30,35,43,71,114,146,150],"date":[29],"duration":[32],"of":[33,41,46,86,105],"incoming":[34],"outgoing":[36],"calls.":[37],"The":[38,73,136],"technological":[39],"advancement":[40],"smartphones":[42],"versatility":[45],"Instant":[47],"Messaging":[48],"(IM)":[49],"applications":[50],"provide":[51],"multiple":[52],"communication":[53],"channels":[54],"to":[55,65,78,100,140],"cybercriminals":[56],"communication,":[58],"making":[59],"it":[60],"difficult":[61],"LEAs":[64,139],"monitor/investigate":[66],"using":[67,108],"traditional":[68],"forensics":[69],"tools":[70],"techniques.":[72],"challenging":[75],"part":[76],"retrieve":[79],"specific":[80,144],"from":[82,132],"network":[84,134,158],"traffic":[85,145],"particular":[88],"IM":[89],"Application":[90],"WhatsApp.":[93],"This":[94],"research":[95],"article's":[96],"primary":[97],"purpose":[98],"find":[101],"IP":[103],"address":[104],"cybercriminal":[107],"WhatsApp":[109],"through":[110],"existing":[111],"sniffing":[112,122],"techniques":[113],"tools.":[115],"A":[116],"method":[117],"called":[118],"rule-based":[119],"extraction":[120],"packets":[123],"proposed":[125],"extracting":[127],"relevant":[130],"data":[131,155],"traffic.":[135,159],"results":[137],"support":[138],"identify":[141],"cybercriminals'":[143],"help":[147],"analyzing":[149],"comparing":[151],"mobile":[153],"phone":[154],"with":[156]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":10},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":8}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}