首页 > 最新文献

2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering最新文献

英文 中文
A Research Configuration for a Digital Network Forensic Lab 数字网络取证实验室的研究配置
Jeffrey S. Marean, M. Losavio, Ibrahim N. Imam
Summary form only given. The digital forensic network lab is implemented with the goal of providing all students and faculty with a configurable research environment ideally suited for conducting network forensic testing on all TCP/IP network protocols passing through it. Of particular interest are protocols that are commonly used for file sharing, message passing, and those that actively obfuscate or encrypt message traffic. Notably, Bit Torrent protocol, P2P protocols, IM (instant messaging) protocols, and anonymizing protocols such as I2P, Thor, and Freenet. Items of interest in protocol analysis include packet payload, sender and receiver real IP address, and crypto analysis.The forensic test bed consists of an a main node populated with a Cisco WAN router. This is the master router for the lab. It routes internal traffic between the three research nodes and selected outside networks. Populating the a node and the two remote nodes, B and C, are a combination of a Cisco routers, Cisco firewalls, Cisco switches, and computers. Each node has five dual core X86 computers capable of running combinations of Linux x86- 32 or -64 OS's, Microsoft x86-32 or -64 OS's, and, if necessary, both OS's can be configured to either use Microsoft, VMWare or Xen virtualization software. The a main node is connected remotely to the C node via a campus fast Ethernet circuit. While the B node, co-located with the a main node, is connected together via a fast Ethernet and Tl circuit. To increase the infrastructure component of the lab we have the ability to selectively place the forensic lab into an existing classroom domain for wider access to students and faculty researchers.
只提供摘要形式。数字取证网络实验室的目标是为所有学生和教师提供一个可配置的研究环境,非常适合对通过它的所有TCP/IP网络协议进行网络取证测试。特别令人感兴趣的是通常用于文件共享、消息传递以及主动混淆或加密消息流量的协议。值得注意的是,Bit Torrent协议、P2P协议、IM(即时通讯)协议和匿名协议,如I2P、Thor和Freenet。协议分析中感兴趣的项目包括数据包有效载荷、发送方和接收方的真实IP地址以及加密分析。取证测试平台由一个带有Cisco WAN路由器的主节点组成。这是实验室的主路由器。它在三个研究节点和选定的外部网络之间路由内部流量。a节点和两个远程节点B和C是Cisco路由器、Cisco防火墙、Cisco交换机和计算机的组合。每个节点有五台双核X86计算机,能够运行Linux X86 -32或-64操作系统、微软X86 -32或-64操作系统的组合,如果有必要,这两种操作系统都可以配置为使用微软、VMWare或Xen虚拟化软件。a主节点通过校园快速以太网电路远程连接到C节点。而B节点与a主节点位于同一位置,通过快速以太网和Tl电路连接在一起。为了增加实验室的基础设施组成部分,我们有能力选择性地将法医实验室置于现有的教室领域,以便更广泛地访问学生和教师研究人员。
{"title":"A Research Configuration for a Digital Network Forensic Lab","authors":"Jeffrey S. Marean, M. Losavio, Ibrahim N. Imam","doi":"10.1109/SADFE.2008.23","DOIUrl":"https://doi.org/10.1109/SADFE.2008.23","url":null,"abstract":"Summary form only given. The digital forensic network lab is implemented with the goal of providing all students and faculty with a configurable research environment ideally suited for conducting network forensic testing on all TCP/IP network protocols passing through it. Of particular interest are protocols that are commonly used for file sharing, message passing, and those that actively obfuscate or encrypt message traffic. Notably, Bit Torrent protocol, P2P protocols, IM (instant messaging) protocols, and anonymizing protocols such as I2P, Thor, and Freenet. Items of interest in protocol analysis include packet payload, sender and receiver real IP address, and crypto analysis.The forensic test bed consists of an a main node populated with a Cisco WAN router. This is the master router for the lab. It routes internal traffic between the three research nodes and selected outside networks. Populating the a node and the two remote nodes, B and C, are a combination of a Cisco routers, Cisco firewalls, Cisco switches, and computers. Each node has five dual core X86 computers capable of running combinations of Linux x86- 32 or -64 OS's, Microsoft x86-32 or -64 OS's, and, if necessary, both OS's can be configured to either use Microsoft, VMWare or Xen virtualization software. The a main node is connected remotely to the C node via a campus fast Ethernet circuit. While the B node, co-located with the a main node, is connected together via a fast Ethernet and Tl circuit. To increase the infrastructure component of the lab we have the ability to selectively place the forensic lab into an existing classroom domain for wider access to students and faculty researchers.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115624046","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Implications of Attorney Experiences with Digital Forensics and Electronic Evidence in the United States 美国律师在数字取证和电子证据方面的经验启示
M. Losavio, D. Keeling, Adel Said Elmaghraby, George E. Higgins, J. Shutt
The experiences of lawyers with electronic evidence and digital forensics are examined. The assessment indicates disparate experiences based on case type as to 1) the use of different types of electronic evidence, 2) disputes over that use and 3) utilization of digital forensics experts. Further study indicates use of electronic evidence continues to increase, from which we infer increased challenges to the reliability of digital forensic testimony.
律师与电子证据和数字取证的经验进行了审查。该评估表明,基于案件类型的不同经验:1)使用不同类型的电子证据;2)使用争议;3)使用数字取证专家。进一步的研究表明,电子证据的使用继续增加,由此我们推断,对数字法医证词可靠性的挑战越来越大。
{"title":"Implications of Attorney Experiences with Digital Forensics and Electronic Evidence in the United States","authors":"M. Losavio, D. Keeling, Adel Said Elmaghraby, George E. Higgins, J. Shutt","doi":"10.1109/SADFE.2008.11","DOIUrl":"https://doi.org/10.1109/SADFE.2008.11","url":null,"abstract":"The experiences of lawyers with electronic evidence and digital forensics are examined. The assessment indicates disparate experiences based on case type as to 1) the use of different types of electronic evidence, 2) disputes over that use and 3) utilization of digital forensics experts. Further study indicates use of electronic evidence continues to increase, from which we infer increased challenges to the reliability of digital forensic testimony.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124565187","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
SÁDI - Statistical Analysis for Data Type Identification SÁDI -数据类型识别的统计分析
Sarah J. Moody, R. Erbacher
A key task in digital forensic analysis is the location of relevant information within the computer system. Identification of the relevancy of data is often dependent upon the identification of the type of data being examined. Typical file type identification is based upon file extension or magic keys. These typical techniques fail in many typical forensic analysis scenarios such as needing to deal with embedded data, such as with Microsoft Word files, or file fragments. The SADI (Statistical Analysis Data Identification) technique applies statistical analysis of the byte values of the data in such a way that the accuracy of the technique does not rely on the potentially misleading metadata information but rather the values of the data itself. The development of SADI provides the capability to identify what digitally stored data actually represents and will also allow for the selective extraction of portions of the data for additional investigation; i.e., in the case of embedded data. Thus, our research provides a more effective type identification technique that does not fail on file fragments, embedded data types, or with obfuscated data.
数字取证分析的一项关键任务是在计算机系统中定位相关信息。数据相关性的识别通常取决于所检查数据类型的识别。典型的文件类型标识基于文件扩展名或魔法键。这些典型的技术在许多典型的取证分析场景中都失败了,比如需要处理嵌入式数据,比如Microsoft Word文件,或者文件片段。SADI(统计分析数据识别)技术以这样一种方式对数据的字节值进行统计分析,即该技术的准确性不依赖于可能具有误导性的元数据信息,而是依赖于数据本身的值。SADI的发展提供了识别数字存储数据实际代表的内容的能力,并且还允许选择性地提取部分数据以供进一步调查;即,在嵌入式数据的情况下。因此,我们的研究提供了一种更有效的类型识别技术,它不会在文件片段、嵌入数据类型或混淆数据上失败。
{"title":"SÁDI - Statistical Analysis for Data Type Identification","authors":"Sarah J. Moody, R. Erbacher","doi":"10.1109/SADFE.2008.13","DOIUrl":"https://doi.org/10.1109/SADFE.2008.13","url":null,"abstract":"A key task in digital forensic analysis is the location of relevant information within the computer system. Identification of the relevancy of data is often dependent upon the identification of the type of data being examined. Typical file type identification is based upon file extension or magic keys. These typical techniques fail in many typical forensic analysis scenarios such as needing to deal with embedded data, such as with Microsoft Word files, or file fragments. The SADI (Statistical Analysis Data Identification) technique applies statistical analysis of the byte values of the data in such a way that the accuracy of the technique does not rely on the potentially misleading metadata information but rather the values of the data itself. The development of SADI provides the capability to identify what digitally stored data actually represents and will also allow for the selective extraction of portions of the data for additional investigation; i.e., in the case of embedded data. Thus, our research provides a more effective type identification technique that does not fail on file fragments, embedded data types, or with obfuscated data.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122659787","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 45
Finding the Evidence in Tamper-Evident Logs 在可篡改日志中查找证据
Daniel Sandler, Kyle Derr, Scott A. Crosby, D. Wallach
Secure logs are powerful tools for building systems that must resist forgery, prove temporal relationships, and stand up to forensic scrutiny. The proofs of order and integrity encoded in these tamper-evident chronological records, typically built using hash chaining, may be used by applications to enforce operating constraints or sound alarms at suspicious activity. However, existing research stops short of discussing how one might go about automatically determining whether a given secure log satisfies a given set of constraints on its records. In this paper, we discuss our work on Querifier, a tool that accomplishes this. It can be used offline as an analyzer for static logs, or online during the runtime of a logging application. Querifier rules are written in a flexible pattern-matching language that adapts to arbitrary log structures; given a set of rules and available log data, Querifier presents evidence of correctness and offers counterexamples if desired. We describe Querfier's implementation and offer early performance results.
安全日志是构建系统的强大工具,这些系统必须能够抵抗伪造、证明时间关系并经得起法医审查。在这些明显易被篡改的时间顺序记录中编码的顺序和完整性证明(通常使用散列链构建)可以被应用程序用于执行操作约束或在可疑活动时发出警报。但是,现有的研究没有讨论如何自动确定给定的安全日志是否满足其记录上的一组给定约束。在本文中,我们讨论了我们在Querifier上的工作,Querifier是一个完成此任务的工具。它可以离线用作静态日志的分析器,也可以在日志应用程序运行期间在线使用。Querifier规则是用灵活的模式匹配语言编写的,可以适应任意的日志结构;给定一组规则和可用的日志数据,Querifier提供正确性的证据,并在需要时提供反例。我们描述了Querfier的实现,并提供了早期的性能结果。
{"title":"Finding the Evidence in Tamper-Evident Logs","authors":"Daniel Sandler, Kyle Derr, Scott A. Crosby, D. Wallach","doi":"10.1109/SADFE.2008.22","DOIUrl":"https://doi.org/10.1109/SADFE.2008.22","url":null,"abstract":"Secure logs are powerful tools for building systems that must resist forgery, prove temporal relationships, and stand up to forensic scrutiny. The proofs of order and integrity encoded in these tamper-evident chronological records, typically built using hash chaining, may be used by applications to enforce operating constraints or sound alarms at suspicious activity. However, existing research stops short of discussing how one might go about automatically determining whether a given secure log satisfies a given set of constraints on its records. In this paper, we discuss our work on Querifier, a tool that accomplishes this. It can be used offline as an analyzer for static logs, or online during the runtime of a logging application. Querifier rules are written in a flexible pattern-matching language that adapts to arbitrary log structures; given a set of rules and available log data, Querifier presents evidence of correctness and offers counterexamples if desired. We describe Querfier's implementation and offer early performance results.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128741771","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Protecting Digital Legal Professional Privilege (LPP) Data 保护数字法律专业特权(LPP)数据
F. Law, P. Lai, Z. L. Jiang, R. Ieong, M. Kwan, K. Chow, L. Hui, S. Yiu, C. Chong
To enable free communication between legal advisor and his client for proper functioning of the legal system, certain documents, known as legal professional privilege (TPP) documents, can be excluded as evidence for prosecution. In physical world, protection of TPP information is well addressed and proper procedure for handling TPP articles has been established. However, there does not exist a forensically sound procedure for protecting "digital" TPP information. In this paper, we try to address this important, but rarely addressed, issue. We point out the difficulties of handling digital TPP data and discuss the shortcomings of the current practices, then we propose a feasible procedure for solving this problem.
为了使法律顾问和客户之间能够自由沟通,使法律制度能够正常运作,某些文件,即法律专业特权(TPP)文件,可以被排除作为起诉的证据。在现实世界中,TPP的信息保护得到了很好的解决,并建立了处理TPP条款的适当程序。然而,对于保护TPP的“数字”信息,目前尚不存在一个法医学上合理的程序。在本文中,我们试图解决这个重要的,但很少被提及的问题。本文指出了数字化TPP数据处理的难点,讨论了当前实践的不足,并提出了解决这一问题的可行方案。
{"title":"Protecting Digital Legal Professional Privilege (LPP) Data","authors":"F. Law, P. Lai, Z. L. Jiang, R. Ieong, M. Kwan, K. Chow, L. Hui, S. Yiu, C. Chong","doi":"10.1109/SADFE.2008.19","DOIUrl":"https://doi.org/10.1109/SADFE.2008.19","url":null,"abstract":"To enable free communication between legal advisor and his client for proper functioning of the legal system, certain documents, known as legal professional privilege (TPP) documents, can be excluded as evidence for prosecution. In physical world, protection of TPP information is well addressed and proper procedure for handling TPP articles has been established. However, there does not exist a forensically sound procedure for protecting \"digital\" TPP information. In this paper, we try to address this important, but rarely addressed, issue. We point out the difficulties of handling digital TPP data and discuss the shortcomings of the current practices, then we propose a feasible procedure for solving this problem.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133954136","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Combining Physical and Digital Evidence in Vehicle Environments 结合车辆环境中的物理和数字证据
D. Nilsson, U. Larson
Traditional forensic investigations of vehicles aims at gathering physical evidence since most crimes involving vehicles are physical. However, in the near future digital crimes on vehicles will most likely surge, and therefore it will be necessary to also gather digital evidence. In this paper, we investigate the possibilities of combining physical and digital evidence in forensic investigations of vehicle crime scenes. We show that digital evidence can be used to improve the investigation of physical crimes and, respectively, that physical evidence can be used to improve the investigation of digital crimes. We also recognize that by gathering purely physical or digital evidence certain crimes cannot be solved. Finally, we show that by combining physical and digital evidence it is possible to distinguish between different types of physical and digital crime.
传统的车辆法医调查的目的是收集物证,因为大多数涉及车辆的犯罪都是物证。然而,在不久的将来,车辆上的数字犯罪很可能会激增,因此也有必要收集数字证据。在本文中,我们探讨了物理和数字证据相结合的可能性在法医调查的车辆犯罪现场。我们表明,数字证据可以用来改善对物理犯罪的调查,分别,物证可以用来改善对数字犯罪的调查。我们也认识到,仅靠收集实物或数字证据无法解决某些犯罪问题。最后,我们表明,通过结合物理和数字证据,可以区分不同类型的物理和数字犯罪。
{"title":"Combining Physical and Digital Evidence in Vehicle Environments","authors":"D. Nilsson, U. Larson","doi":"10.1109/SADFE.2008.10","DOIUrl":"https://doi.org/10.1109/SADFE.2008.10","url":null,"abstract":"Traditional forensic investigations of vehicles aims at gathering physical evidence since most crimes involving vehicles are physical. However, in the near future digital crimes on vehicles will most likely surge, and therefore it will be necessary to also gather digital evidence. In this paper, we investigate the possibilities of combining physical and digital evidence in forensic investigations of vehicle crime scenes. We show that digital evidence can be used to improve the investigation of physical crimes and, respectively, that physical evidence can be used to improve the investigation of digital crimes. We also recognize that by gathering purely physical or digital evidence certain crimes cannot be solved. Finally, we show that by combining physical and digital evidence it is possible to distinguish between different types of physical and digital crime.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129358443","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 16
Legal Issues Pertaining to the Development of Digital Forensic Tools 与数字取证工具发展有关的法律问题
Charles W. Adams
Developers of new and improved forensic tools need to design them with the end result of their use in court in mind. Law enforcement must be able to show that the forensic tools and techniques produce reliable evidence in order for a court to consider it. Reliability is enhanced by demonstration that the forensic tools conform to the general standards within the forensic community. In addition, forensic tools must have adequate safeguards to protect the privacy of the public. Designing forensic tools so that they produce audit trails may help to verify that the use of forensic tools is limited appropriately to comply with court authorization.
新的和改进的法医工具的开发人员在设计它们时需要考虑到它们在法庭上使用的最终结果。执法部门必须能够证明法医工具和技术能够产生可靠的证据,以便法院予以考虑。通过证明法医工具符合法医社区的一般标准,提高了可靠性。此外,法医工具必须有足够的保障措施,以保护公众的隐私。设计取证工具以产生审计跟踪可能有助于核实取证工具的使用是否受到适当限制,以遵守法院授权。
{"title":"Legal Issues Pertaining to the Development of Digital Forensic Tools","authors":"Charles W. Adams","doi":"10.1109/SADFE.2008.17","DOIUrl":"https://doi.org/10.1109/SADFE.2008.17","url":null,"abstract":"Developers of new and improved forensic tools need to design them with the end result of their use in court in mind. Law enforcement must be able to show that the forensic tools and techniques produce reliable evidence in order for a court to consider it. Reliability is enhanced by demonstration that the forensic tools conform to the general standards within the forensic community. In addition, forensic tools must have adequate safeguards to protect the privacy of the public. Designing forensic tools so that they produce audit trails may help to verify that the use of forensic tools is limited appropriately to comply with court authorization.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"147 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130643040","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 31
Node-Based Probing and Monitoring to Investigate Use of Peer-to-Peer Technologies for Distribution of Contraband Material 基于节点的探测和监测以调查使用点对点技术分发违禁品的情况
O. Nasraoui, D. Keeling, Adel Said Elmaghraby, George E. Higgins, M. Losavio
We consider the requirements for node-based probing and monitoring for network forensic investigation of the use of peer-to-peer technologies for distribution of contraband material. The architecture of peer-to-peer (P2P) data exchanges must be examined for opportunities to capture data on the transfer of contraband data with a focus on node structures in P2P exchanges. This examination is of technical, social and legal aspects of P2P use leading to the design and testing offorensically-sound investigative tools and protocols. Computational research must examine: 1. Undercover Node-based Probing and Monitoring to Build an Approximate Model of Network Activity 2. Flagging Contraband Content (keyword, hashes, other patterns) 3. Evaluation against different recipient querying, distribution and routing cases 4. Using the Evaluation results to fine-tune the node positioning strategy Legal and social research is needed to examine the U.S. and transnational legal constraints on the use of particular tools and the presence of possible behavioral signatures.
我们考虑了对使用点对点技术分发违禁品进行网络取证调查的基于节点的探测和监控的要求。必须检查点对点(P2P)数据交换的体系结构,以便有机会捕获关于走私数据传输的数据,重点关注P2P交换中的节点结构。这项检查是技术,社会和法律方面的P2P使用导致设计和测试犯罪健全的调查工具和协议。计算研究必须考察:1。基于隐蔽节点的探测和监控构建网络活动近似模型2。标记违禁品内容(关键字,哈希值,其他模式)针对不同收件人查询、分发和路由情况的评估需要进行法律和社会研究,以检查美国和跨国法律对使用特定工具和可能的行为特征的限制。
{"title":"Node-Based Probing and Monitoring to Investigate Use of Peer-to-Peer Technologies for Distribution of Contraband Material","authors":"O. Nasraoui, D. Keeling, Adel Said Elmaghraby, George E. Higgins, M. Losavio","doi":"10.1109/SADFE.2008.16","DOIUrl":"https://doi.org/10.1109/SADFE.2008.16","url":null,"abstract":"We consider the requirements for node-based probing and monitoring for network forensic investigation of the use of peer-to-peer technologies for distribution of contraband material. The architecture of peer-to-peer (P2P) data exchanges must be examined for opportunities to capture data on the transfer of contraband data with a focus on node structures in P2P exchanges. This examination is of technical, social and legal aspects of P2P use leading to the design and testing offorensically-sound investigative tools and protocols. Computational research must examine: 1. Undercover Node-based Probing and Monitoring to Build an Approximate Model of Network Activity 2. Flagging Contraband Content (keyword, hashes, other patterns) 3. Evaluation against different recipient querying, distribution and routing cases 4. Using the Evaluation results to fine-tune the node positioning strategy Legal and social research is needed to examine the U.S. and transnational legal constraints on the use of particular tools and the presence of possible behavioral signatures.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128109776","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Exemplifying Attack Identification and Analysis in a Novel Forensically Viable Syslog Model 在一种新的法医可行的Syslog日志模型中举例说明攻击识别和分析
S. Monteiro, R. Erbacher
This research builds on our method for validating syslog entries proposed in [5]. The goal of the proposed method is to allow syslog files to be forensically viable. The goal with this phase of the work is to implement the proposed method and evaluate the forensic validity of the method under real-world conditions. This paper discusses that implementation and the ability for the generated authentication logs and access fingerprints to both identify malicious activity and identify the source of this activity. While work has been done to develop secure log files, i.e., making them tamper resistant, there has been no prior work to ensure they are forensically valid.
这项研究建立在我们在[5]中提出的验证syslog条目的方法之上。建议的方法的目标是允许syslog文件在法医上是可行的。本阶段工作的目标是实现所提出的方法,并评估该方法在现实世界条件下的法医有效性。本文讨论了该实现以及生成的身份验证日志和访问指纹识别恶意活动和识别该活动来源的能力。虽然已经完成了开发安全日志文件的工作,即使它们具有防篡改性,但之前没有工作来确保它们在法律上是有效的。
{"title":"Exemplifying Attack Identification and Analysis in a Novel Forensically Viable Syslog Model","authors":"S. Monteiro, R. Erbacher","doi":"10.1109/SADFE.2008.14","DOIUrl":"https://doi.org/10.1109/SADFE.2008.14","url":null,"abstract":"This research builds on our method for validating syslog entries proposed in [5]. The goal of the proposed method is to allow syslog files to be forensically viable. The goal with this phase of the work is to implement the proposed method and evaluate the forensic validity of the method under real-world conditions. This paper discusses that implementation and the ability for the generated authentication logs and access fingerprints to both identify malicious activity and identify the source of this activity. While work has been done to develop secure log files, i.e., making them tamper resistant, there has been no prior work to ensure they are forensically valid.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"107 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124992223","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
Towards the Virtual Memory Space Reconstruction for Windows Live Forensic Purposes 面向Windows实时取证目的的虚拟内存空间重构
Antonio Savoldi, P. Gubian
The aim of this paper is to demonstrate the usefulness of the pagefile in a live forensic context. The forensic science is striving to find new methodologies to analyze the massive quantity of data normally present in a medium-sized workstation, which can have up to several terabytes of storage devices. As a result, the live forensic approach seems to be the only one which can guarantee promptness in obtaining evidential data to be used in the investigative process. The current approach of volatile forensic analysis does not consider the pagefile as an important element to be used in the analysis. Therefore, we have developed a solution which permits to correlate evidential data within the pagefile to the relative process located in the RAM dump. This work can be considered a natural extension of our previous work on this topic.
本文的目的是在现场取证环境中演示页面文件的有用性。法医科学正在努力寻找新的方法来分析通常存在于中型工作站中的大量数据,这些工作站可以拥有高达几tb的存储设备。因此,现场取证方法似乎是唯一能够保证迅速取得证据数据供调查过程使用的方法。当前的挥发性取证分析方法没有将页面文件视为分析中使用的重要元素。因此,我们开发了一种解决方案,允许将页文件中的证据数据与位于RAM转储中的相关进程相关联。这项工作可以被认为是我们以前在这个主题上的工作的自然延伸。
{"title":"Towards the Virtual Memory Space Reconstruction for Windows Live Forensic Purposes","authors":"Antonio Savoldi, P. Gubian","doi":"10.1109/SADFE.2008.21","DOIUrl":"https://doi.org/10.1109/SADFE.2008.21","url":null,"abstract":"The aim of this paper is to demonstrate the usefulness of the pagefile in a live forensic context. The forensic science is striving to find new methodologies to analyze the massive quantity of data normally present in a medium-sized workstation, which can have up to several terabytes of storage devices. As a result, the live forensic approach seems to be the only one which can guarantee promptness in obtaining evidential data to be used in the investigative process. The current approach of volatile forensic analysis does not consider the pagefile as an important element to be used in the analysis. Therefore, we have developed a solution which permits to correlate evidential data within the pagefile to the relative process located in the RAM dump. This work can be considered a natural extension of our previous work on this topic.","PeriodicalId":391486,"journal":{"name":"2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132654298","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
期刊
2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1