An eBPF-based packet capture system with embedded application metadata for network forensics

In network forensics, identifying applications involved in packet transmission and reception is crucial for reconstructing the chain of events in security incidents. However, since captured packets do not contain information about specific applications, investigators must rely on other information like log data for identification, which decreases the efficiency and accuracy of the forensic process. This paper proposes a new system that uses extended Berkeley Packet Filter (eBPF) to embed application metadata directly into the packet capture files. To demonstrate the feasibility of this concept, we implemented a prototype of the proposed system. The system associates each packet with the corresponding application name, process ID, and user ID, storing this metadata alongside packet data in the PCAPNG format. An experimental evaluation comparing the system's performance to a conventional packet capture tool revealed challenges, such as packet loss due to buffer overwriting and increased resource consumption. Despite these limitations, the system is expected to reduce analysis time and improve accuracy in network forensics by eliminating the need to reference log data. Future improvements will focus on optimizing resource usage and enhancing the system stability.