A LOGIC-BASED NETWORK FORENSIC MODEL FOR EVIDENCE ANALYSIS

Abstract : Many attackers tend to use sophisticated multi-stage and/or multi-host attack techniques and anti-forensic tools to cover their traces. Due to the limitations of current intrusion detection and network forensic analysis tools, reconstructing attack scenarios from evidence left behind by attackers of enterprise systems is challenging. In particular, reconstructing attack scenarios using intrusion detection system alerts and system logs that have too many false positives is a big challenge.This chapter presents a model and an accompanying software tool that systematically addresses the reconstruction of attack scenarios in a manner that could stand up in court. The problems faced in such reconstructions include large amounts of data (including irrelevant data), missing evidence and evidence corrupted or destroyed by anti-forensic techniques. The model addresses these problems using various methods, including mapping evidence to system vulnerabilities, inductive reasoning and abductive reasoning, to reconstruct attack scenarios. The Prolog-based system employs known vulnerability databases and an anti-forensic database that will eventually be extended to a standardized database like the NIST National Vulnerability Database. The system, which is designed for network forensic analysis, reduces the time and effort required to reach definite conclusions about how network attacks occurred.
Type de document :
Communication dans un congrès
Gilbert Peterson; Sujeet Shenoi. 11th IFIP International Conference on Digital Forensics (DF), Jan 2015, Orlando, FL, United States. IFIP Advances in Information and Communication Technology, AICT-462, pp.129-145, 2015, Advances in Digital Forensics XI. 〈10.1007/978-3-319-24123-4_8〉
Liste complète des métadonnées

Littérature citée [14 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01449074
Contributeur : Hal Ifip <>
Soumis le : lundi 30 janvier 2017 - 09:13:51
Dernière modification le : vendredi 1 décembre 2017 - 01:17:00

Fichier

978-3-319-24123-4_8_Chapter.pd...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Changwei Liu, Anoop Singhal, Duminda Wijesekera. A LOGIC-BASED NETWORK FORENSIC MODEL FOR EVIDENCE ANALYSIS. Gilbert Peterson; Sujeet Shenoi. 11th IFIP International Conference on Digital Forensics (DF), Jan 2015, Orlando, FL, United States. IFIP Advances in Information and Communication Technology, AICT-462, pp.129-145, 2015, Advances in Digital Forensics XI. 〈10.1007/978-3-319-24123-4_8〉. 〈hal-01449074〉

Partager

Métriques

Consultations de la notice

112

Téléchargements de fichiers

1