An efficient forensic evidence collection scheme of host infringement at the occurrence time

Authors:
Yoon-Ho Choi;Jong-Ho Park;Sang-Kon Kim;Seung-Woo Seo;Yu Kang;Jin-Gi Choe;Ho-Kun Moon;Myung-Soo Rhee
Affiliations:
School of Electrical and Computer Engineering, Seoul National University, Seoul, Korea;School of Electrical and Computer Engineering, Seoul National University, Seoul, Korea;School of Electrical and Computer Engineering, Seoul National University, Seoul, Korea;School of Electrical and Computer Engineering, Seoul National University, Seoul, Korea;KT Information Security Center, Seoul, Korea;KT Information Security Center, Seoul, Korea;KT Information Security Center, Seoul, Korea;KT Information Security Center, Seoul, Korea
Venue:
ICISC'06 Proceedings of the 9th international conference on Information Security and Cryptology
Year:
2006

Citing 4
Cited 0

A requires/provides model for computer attacks

Proceedings of the 2000 workshop on New security paradigms
Aggregation and Correlation of Intrusion-Detection Alerts

RAID '00 Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection
Alert Correlation in a Cooperative Intrusion Detection Framework

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
M2D2: a formal data model for IDS alert correlation

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

The Computer Forensics is a research area that finds the malicious users by collecting and analyzing the intrusion or infringement evidence of computer crimes such as hacking. Many researches about Computer Forensics have been done so far. But those researches have focused on how to collect the forensic evidence for both analysis and proofs after receiving the intrusion or infringement reports of hosts from computer users or network administrators. In this paper, we describe how to selectively collect the forensic evidence of good quality from observable and protective hosts at the time of infringement occurrence by malicious users. By correlating the event logs of Intrusion Detection Systems(IDSes) and hosts with the configuration information of hosts periodically, we calculate the value of infringement severity that implies the real infringement possibility of the hosts. Based on this severity value, we selectively collect the evidence for proofs at the time of infringement occurrence. As a result, we show that we can minimize the information damage of the evidence for both analysis and proofs, and reduce the amount of data which are used to analyze the degree of infringement severity.