A temporal logic-based model for forensic investigation in networked system security

  • Authors:

  • Slim Rekhis;Noureddine Boudriga

  • Affiliations:

  • CN&S Research Lab., University of the 7th Of November at Carthage, Tunisia;CN&S Research Lab., University of the 7th Of November at Carthage, Tunisia

  • Venue:
  • MMM-ACNS'05 Proceedings of the Third international conference on Mathematical Methods, Models, and Architectures for Computer Network Security
  • Year:
  • 2005

Quantified Score

Hi-index 0.02

Visualization

Abstract

Research in computer and network forensic investigation has recently addressed the development of procedural guidelines, technical documents, and semi-automation tools. It has however omitted the need of formal proof. This work provides a novel approach that formalizes and automates the proof in digital forensic investigation. First, it brings out a formal logic-based language, called S-TLA+, to enable reasoning on systems with uncertainty, by adding forward hypotheses to fulfill potential lack of details. S-TLA+ is suitable for the description of evidences, as well as elementary scenarios fragments representing the investigators knowledge. Secondly, the proposal provides an automated verification tool, S-TLC, to prove the correctness of S-TLA+ specifications. It checks whether there are possible hacking scenarios that meet the available digital evidences, and explores additional evidences. To demonstrate its effectiveness, the formalized analysis is applied on a compromised host.