Delhi Police get 5-step workflow, guide on how to analyse internet activity amid 'spike in IDPR analysis'

Delhi Police has issued standardised guidelines for IPDR and dump-data analysis, including digital activity mapping, VPN detection, behavioural profiling etc

Delhi Police has standardised Internet Protocol Detail Records (IPDR) and dump-data analysis through a series of training material amid increased demand for such data during major incidents and mass gatherings.

Delhi Police, The force has standardised IPDR and dump-data analysis procedures for investigators. (ANI file photo)

With separate cyber police stations in each district and specialised units in crime branch and cell, police said SOPs have been created for all investigators. The documents were released on Saturday.

A senior police officer said, “We have laid out guidelines since there’s a spike in IPDR analysis. There’s dump data analysis during any incident, such as the Red Fort blast, any heinous case, or even large scale planned processions.”

IPDR helps investigators map online activity

One document, prepared by a sub inspector of the Delhi Police and seen by HT, said IPDR contains metadata of the user’s internet activity, and can help investigators establish how much data was exchanged and which service or application was accessed through timestamps, source and destination IP addresses, source and destination ports, bytes uploaded and downloaded, session duration, and subscriber identifiers.

IPDR can be correlated with call detail records (CDRs), customer application forms (KYC details), and mobile tower data to provide a “complete picture of any user activity”

The combination of internet activity with voice/SMS communication and physical location can lead police to trace the user’s device and his internet activity.

Police guidelines flag VPN, proxy activity

Another document offered guidelines on how to identify VPN and proxy services, among others, including connections to unusual or high-risk IP addresses, traffic through uncommon ports, long-duration sessions involving relatively little data, encrypted traffic on non-standard ports, repeated connections to the same remote IP and unusually high data volumes during odd hours.

The training material also stresses that investigators should document their findings through “timelines and screenshots” and maintain legal authorisation, chain of custody, data integrity and subscriber privacy while handling such records.

Five-step process for analysing IPDR

The training material lays out a five-step workflow for analysing IPDR — data ingestion and normalisation, IP and port mapping, correlation, behavioural profiling, and reporting and evidence.

Under behavioural profiling, investigators are advised to create user activity timelines and identify patterns, anomalies and unusual data spikes. The document also instructs them to examine VPN, proxy and Tor-related activity and connections to potentially malicious infrastructure.

“From ordering banned items, to searching for content on dark web, VPN is heavily used now,” said an officer.

Ask HT

Frequently Asked Questions

What is IPDR?

How does the Delhi Police use IPDR?

What is the significance of the training material released by the Delhi Police?

What steps are included in the IPDR analysis workflow?