Hypervisor event logs as a source of consistent virtual machine evidence for forensic cloud investigations

Authors:
Sean Thorpe;Indrajit Ray;Tyrone Grandison;Abbie Barbir;Robert France
Affiliations:
Faculty of Engineering & Computing, University of Technology, Kingston, Jamaica;Department of Computer Science, Colorado State University, Fort Collins;Proficiency Labs Intl, Ashland, Oregon;Bank of America, Canada;Department of Computer Science, Colorado State University, Fort Collins
Venue:
DBSec'13 Proceedings of the 27th international conference on Data and Applications Security and Privacy XXVII
Year:
2013

Citing 8
Cited 0

Logical Time in Distributed Computing Systems

Computer - Distributed computing systems: separate resources acting as one
Time, clocks, and the ordering of events in a distributed system

Communications of the ACM
Log Auditing through Model-Checking

CSFW '01 Proceedings of the 14th IEEE workshop on Computer Security Foundations
Timestamp evidence correlation by model based clock hypothesis testing

Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
Visual and algorithmic tooling for system trace analysis: a case study

ACM SIGOPS Operating Systems Review
Trail of bytes: efficient support for forensic analysis

Proceedings of the 17th ACM conference on Computer and communications security
Enforcing data quality rules for a synchronized VM log audit environment using transformation mapping techniques

CISIS'11 Proceedings of the 4th international conference on Computational intelligence in security for information systems
Time and date issues in forensic computing-a case study

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Quantified Score

Hi-index	0.00

Visualization

Abstract

Cloud Computing is an emerging model of computing where users can leverage the computing infrastructure as a service stack or commodity. The security and privacy concerns of this infrastructure arising from the large co-location of tenants are, however, significant and pose considerable challenges in its widespread deployment. The current work addresses one aspect of the security problem by facilitating forensic investigations to determine if these virtual tenant spaces were maliciously violated by other tenants. It presents the design, application and limitations of a software prototype called the Virtual Machine (VM) Log Auditor that helps in detecting inconsistencies within the activity timelines for a VM history. A discussion on modeling a consistent approach is also provided.