Quality assurance evidence collection model for MSN forensics

Authors:
Bo-Chao Cheng;Huan Chen;Ryh-Yuh Tseng
Affiliations:
Department of Communications Engineering, National Chung-Cheng University, Chiayi, Taiwan 621;Department of Communications Engineering, National Chung-Cheng University, Chiayi, Taiwan 621;Department of Communications Engineering, National Chung-Cheng University, Chiayi, Taiwan 621
Venue:
Journal of Intelligent Manufacturing
Year:
2010

Citing 3
Cited 1

Network Forensics Analysis

IEEE Internet Computing
Persistent dropping: an efficient control of traffic aggregates

Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Tool review: Network traffic as a source of evidence: tool strengths, weaknesses, and future needs

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Content-based control of HTTPs mail for implementation of IT-convergence security environment

Journal of Intelligent Manufacturing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Instant Messaging (IM) applications have become an important tool for business and social communication. However, when using IM, individuals and companies expose themselves to many security threats. Collecting all available data and preserving the integrity of evidence is a challenging task to perform IM forensics. In particular, under resource constrained situations, a good evidence collection mechanism is required to provide effective event collection in a network environment with heavy traffic. The emphasis of this paper is on the development of an effective evidence collection control mechanism that achieves an optimal outcome with a reasonable forensic service requests acceptance ratio and tolerable level of data capture loss. In this paper, we propose an evidence collection control model used in network forensics, called Quality Assurance Evidence Collection (QAEC). QAEC dynamically adjusts the amount of data to be collected on an evidence flow according to the storage capacity level. QAEC is firstly modeled as the Continuous Time Markov Chain (CTMC) and is realized by a cost function that comprises both flow-level and packet-level components to reflect the efforts on the evidence reconstruction process. We also present a prototype system (known as the MSN-Shot) as a MSN forensic system which uses QAEC to select an appropriate evidence collection strategy to maximize the given cost function. With the numerical analysis and prototype results, this study confirmed that the QAEC model meets cost-effective requirements and provides a practical security solution and guarantees a high level of quality assurance for network forensics.