Network forensic system for performing transmission metadata tracking and analysis

A system operable to analyze, review, consolidate and present a real-time view of transmission traffic patterns, the system comprising:

• a receiver operable to receive a plurality of transmission control protocol/internet protocol (“TCP/IP”) transmissions, each transmission comprising a header and a body, each transmission comprising a plurality of metadata elements within a portion of a header, said portion of the header being previously determined to be unused, each plurality of metadata elements comprising:
• an originating internet protocol (“IP”) address;
• a sent timestamp for the transmission;
• account reconciliation data;
• and
• billing data;
• an artificial intelligence module comprising:
• a transmission identification stamper sub-module operable to stamp each transmission with an identifier in order to identify the transmission;
• a network layer forensic detector sub-module operable to detect an originating location in order to identify man-in-the-middle attacks;
• a cognitive data and content analysis sub-module operable to:
• for each identified transmission:
• extract technical characteristics;
• retrieve stored historic technical characteristics, said stored historic technical characteristics including a predetermined amount of data that is equivalent to data included in the technical characteristics that have been extracted;
• compare the stored historic technical characteristics to the extracted technical characteristics in order to identify an anomalous transmission;
• quarantine an identified anomalous transmission;
• and
• store the technical characteristics of the transmission and whether the transmission was quarantined;
• and
• a real-time display operable to display each transmission together with results of the artificial intelligence module.

A method for extracting, correlating, consolidating and presenting metadata from transmissions, the method comprising:

• receiving a transmission control protocol/internet protocol (“TCP/IP”) transmission from a sender, said transmission comprising a body and a header, said header comprising a plurality of options;
• extracting an originating IP address from an IP address location of the transmission, said originating IP address being extracted in a binary form;
• determining an accuracy and validity metric of the transmission using an artificial intelligence module, said artificial intelligence module:
• reviewing a plurality of metadata elements included in the transmission, the plurality of metadata elements comprising:
• a queue selection;
• a transmission time stamp;
• the originating IP address;
• a downstream destination location;
• a plurality of transmission network stops, each transmission network stop comprising:
• a location in which the transmission was located;
• one or more metadata modifications that occurred at the location;
• and
• a valid reason for the one or more metadata modifications;
• comparing the originating IP address to the remaining metadata elements within the transmission;
• based on the reviewing and the comparing, determining whether the transmission is a valid transmission or an invalid transmission;
• quarantining the transmission when the transmission is determined to be an invalid transmission;
• converting the extracted IP address from binary form into hexadecimal form when the transmission is determined to a valid transmission;
• embedding the hexadecimal form of the IP address into one or more unused options included in the plurality of options when the transmission is determined to be valid transmission;
• and
• processing the transmission when the transmission is determined to be a valid transmission.