{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,12]],"date-time":"2026-05-12T18:03:05Z","timestamp":1778608985196,"version":"3.51.4"},"reference-count":20,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2024,5,16]],"date-time":"2024-05-16T00:00:00Z","timestamp":1715817600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Ministry of Internal Affairs and Communications","award":["JPJ000254"],"award-info":[{"award-number":["JPJ000254"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Digital"],"abstract":"<jats:p>In the process of collecting evidence of activities and events in network devices, there are problems with content and storage, and we aim to solve the problems faced by network devices in network forensics. In this paper, we propose a simple method for solving the problems with content and storage in acquiring communication logs on end hosts, implement a sniffing tool that captures raw packets with communication event control, compare it with existing tools, and conduct experiments and considerations. Through these experiments and considerations, we confirmed that the proposed communication log acquisition method can be implemented on the end host, and that the problem can be solved by using a tool that implements the proposed method. Also, we confirmed that it can be applied to real-world communication log collection scenarios, and that it can coexist with existing systems and tools that collect communication logs.<\/jats:p>","DOI":"10.3390\/digital4020024","type":"journal-article","created":{"date-parts":[[2024,5,16]],"date-time":"2024-05-16T09:30:03Z","timestamp":1715851803000},"page":"483-500","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["A Method for Solving Problems in Acquiring Communication Logs on End Hosts"],"prefix":"10.3390","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-0693-1039","authenticated-orcid":false,"given":"Youji","family":"Fukuta","sequence":"first","affiliation":[{"name":"Faculty of Science and Engineering, Cyber Informatics Research Institute, Kindai University, Higashiosaka 577-8502, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8970-9408","authenticated-orcid":false,"given":"Yoshiaki","family":"Shiraishi","sequence":"additional","affiliation":[{"name":"Graduate School of Engineering, Kobe University, Kobe 657-8501, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-6990-1456","authenticated-orcid":false,"given":"Masanori","family":"Hirotomo","sequence":"additional","affiliation":[{"name":"Faculty of Science and Engineering, Saga University, Saga 840-8502, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4644-4550","authenticated-orcid":false,"given":"Masami","family":"Mohri","sequence":"additional","affiliation":[{"name":"Faculty of Science and Engineering, Cyber Informatics Research Institute, Kindai University, Higashiosaka 577-8502, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2024,5,16]]},"reference":[{"key":"ref_1","unstructured":"Davidoff, S., and Ham, J. (2012). Network Forensics: Tracking Hackers through Cyberspace, Pearson Education, Inc."},{"key":"ref_2","unstructured":"(2024, January 10). NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response, Available online: https:\/\/csrc.nist.gov\/pubs\/sp\/800\/86\/final."},{"key":"ref_3","first-page":"836","article-title":"Detection and analysis cerber ransomware based on network forensics behavior","volume":"20","author":"Kurniawan","year":"2018","journal-title":"Int. J. Netw. Secur."},{"key":"ref_4","first-page":"879","article-title":"Network Forensics: A Comprehensive Review of Tools and Techniques","volume":"12","author":"Qureshi","year":"2021","journal-title":"Int. J. Adv. Comput. Sci. Appl. (IJACSA)"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Li, J., Wu, C., Ye, J., Ding, J., Fu, Q., and Huang, J. (2019, January 5\u20138). The Comparison and Verification of Some Efficient Packet Capture and Processing Technologies. Proceedings of the 2019 IEEE International Conference on Dependable, Autonomic and Secure Computing, International Conference on Pervasive Intelligence and Computing, International Conference on Cloud and Big Data Computing, International Conference on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech), Fukuoka, Japan.","DOI":"10.1109\/DASC\/PiCom\/CBDCom\/CyberSciTech.2019.00177"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"200892","DOI":"10.1016\/j.fsidi.2019.200892","article-title":"Packet analysis for network forensics: A comprehensive survey","volume":"32","author":"Sikos","year":"2020","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"11935","DOI":"10.1109\/TVT.2023.3270859","article-title":"Digital Twin-Assisted Edge Computation Offloading in Industrial Internet of Things With NOMA","volume":"72","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Saponara, S., Elhanashi, A., and Gagliardi, A. (2021, January 12). Reconstruct fingerprint images using deep learning and sparse autoencoder algorithms. Proceedings of the Real-Time Image Processing and Deep Learning 2021, Online.","DOI":"10.1117\/12.2585707"},{"key":"ref_9","unstructured":"(2024, January 10). Windows Filtering Platform. Available online: https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/fwp\/windows-filtering-platform-start-page."},{"key":"ref_10","unstructured":"(2024, April 10). Introduction to I\/O Control Codes. Available online: https:\/\/github.com\/MicrosoftDocs\/windows-driver-docs\/blob\/staging\/windows-driver-docs-pr\/kernel\/defining-i-o-control-codes.md."},{"key":"ref_11","unstructured":"(2024, April 10). Writing IRP Dispatch Routines. Available online: https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/ifs\/writing-irp-dispatch-routines?source=recommendations."},{"key":"ref_12","unstructured":"netfilter (2024, April 10). Available online: https:\/\/netfilter.org\/."},{"key":"ref_13","unstructured":"(2024, April 10). OpenBSD PF\u2014User\u2019s Guide. Available online: https:\/\/www.openbsd.org\/faq\/pf\/index.html."},{"key":"ref_14","unstructured":"(2024, April 10). Using KMDF Verifier. Available online: https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/drivers\/wdf\/using-kmdf-verifier."},{"key":"ref_15","unstructured":"(2024, January 10). RFC3954 Cisco Systems NetFlow Services Export V9 October. Available online: https:\/\/www.ietf.org\/rfc\/rfc3954.txt."},{"key":"ref_16","unstructured":"(2024, January 10). RFC5424 The Syslog Protocol March 2009. Available online: https:\/\/www.ietf.org\/rfc\/rfc5424.txt."},{"key":"ref_17","unstructured":"WIRESHARK (2024, January 10). Available online: https:\/\/www.wireshark.org."},{"key":"ref_18","unstructured":"TCPDUMP & LiBPCAP (2024, January 10). Available online: https:\/\/www.tcpdump.org."},{"key":"ref_19","unstructured":"(2024, January 10). iPerf\u2014The Ultimate Speed Test Tool for TCP, UDP and SCTP. Available online: https:\/\/iperf.fr."},{"key":"ref_20","unstructured":"(2024, January 10). Testlimit v5.24. Available online: https:\/\/learn.microsoft.com\/ja-jp\/sysinternals\/downloads\/testlimit."}],"container-title":["Digital"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2673-6470\/4\/2\/24\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T14:43:23Z","timestamp":1760107403000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2673-6470\/4\/2\/24"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,16]]},"references-count":20,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2024,6]]}},"alternative-id":["digital4020024"],"URL":"https:\/\/doi.org\/10.3390\/digital4020024","relation":{},"ISSN":["2673-6470"],"issn-type":[{"value":"2673-6470","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,5,16]]}}}