This research is focused on the calculation of the efficiency of the storage medium and the optimum point combination fingerprint length, degree of similarity and storage media. | International Journal of Computer Networks and Communications Security VOL. 3, NO. 3, MARCH 2015, 95–102 Available online at: E-ISSN 2308-9830 (Online) / ISSN 2410-0595 (Print) Media Storage Efficiency and Level Fingerprint Similarity in Network Forensic Analysis using Winnowing Multihashing Method Irwan Sembiring1, Jazi Eko Istiyanto2, Edi Winarko3 and Ahmad Ashari4 1 2, 3, 4 Satya Wacana Christian University, Salatiga, Indonesia Department of Computer Science and Electronics, Faculty of Mathematics and Natural Sciences, GadjahMada, University, Yogyakarta, Indonesia E-mail: 1irwan@ , 2jazi@, 3ewinarko@, 4ashari@ ABSTRACT Network forensics is a developing network security models that focused on the capture, recording, and analysis of network traffic, for the purposes of investigation. One of the problems in the Network forensics is the quantity or volume of data problems. Winnowing Multi hashing method can be used to conduct an investigation of attacks on the network forensic analysis. Value of Fingerprint is generated on Winnowing method Multi hashing (WMH), can be used as a marker of an attack that was captured by the Intrusion Detection System (IDS). WMH is a method that only takes excerpt of a payload. With this algorithm, the payload volume will be much more efficient because it only stores the fingerprint alone. This research is focused on the calculation of the efficiency of the storage medium and the optimum point combination fingerprint length, degree of similarity and storage media. Keywords: Winnowing Multi hashing, Jaccard Similarity, Network Forensic. 1 INTRODUCTION According to the agency Digital Forensics Research Workshop (DFRWS), digital forensic activities include preservation, collection, validation, identification, analysis, interpretation, documentation and presentation [1]. Because the equipment connected to the internet is increasingly a lot, then a forensic investigator will .
