Skip to Main content Skip to Navigation
Conference papers

Identifying Evidence for Cloud Forensic Analysis

Abstract : Cloud computing provides benefits such as increased flexibility, scalability and cost savings to enterprises. However, it introduces several challenges to digital forensic investigations. Current forensic analysis frameworks and tools are largely intended for off-line investigations and it is assumed that the logs are under investigator control. In cloud computing, however, evidence can be distributed across several machines, most of which would be outside the control of the investigator. Other challenges include the dependence of forensically-valuable data on the cloud deployment model, large volumes of data, proprietary data formats, multiple isolated virtual machine instances running on a single physical machine and inadequate tools for conducting cloud forensic investigations.This research demonstrates that evidence from multiple sources can be used to reconstruct cloud attack scenarios. The sources include: (i) intrusion detection system and application software logs; (ii) cloud service API calls; and (iii) system calls from virtual machines. A forensic analysis framework for cloud computing environments is presented that considers logged data related to activities in the application layer as well as lower layers. A Prolog-based forensic analysis tool is used to automate the correlation of evidence from clients and the cloud service provider in order to reconstruct attack scenarios in a forensic investigation.
Complete list of metadatas

Cited literature [18 references]  Display  Hide  Download

https://hal.inria.fr/hal-01716407
Contributor : Hal Ifip <>
Submitted on : Friday, February 23, 2018 - 3:50:50 PM
Last modification on : Friday, February 23, 2018 - 3:51:51 PM
Document(s) archivé(s) le : Friday, May 25, 2018 - 4:51:06 AM

File

456364_1_En_7_Chapter.pdf
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Changwei Liu, Anoop Singhal, Duminda Wijesekera. Identifying Evidence for Cloud Forensic Analysis. 13th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2017, Orlando, FL, United States. pp.111-130, ⟨10.1007/978-3-319-67208-3_7⟩. ⟨hal-01716407⟩

Share

Metrics

Record views

174

Files downloads

54