Toward Models for Forensic Analysis

Authors:
Sean Peisert;Matt Bishop;Sidney Karin;Keith Marzullo
Affiliations:
University of California, San Diego, USA;University of California, Davis, USA;University of California, San Diego, USA;University of California, San Diego, USA
Venue:
SADFE '07 Proceedings of the Second International Workshop on Systematic Approaches to Digital Forensic Engineering
Year:
2007

Citing 0
Cited 8

Computer forensics in forensis

ACM SIGOPS Operating Systems Review
Towards easing the diagnosis of bugs in OS code

Proceedings of the 4th workshop on Programming languages and operating systems
Integrating intrusion alert information to aid forensic explanation: An analytical intrusion detection framework for distributive IDS

Information Fusion
E-voting and forensics: prying open the black box

EVT/WOTE'09 Proceedings of the 2009 conference on Electronic voting technology/workshop on trustworthy elections
Modeling and analyzing faults to improve election process robustness

EVT/WOTE'10 Proceedings of the 2010 international conference on Electronic voting technology/workshop on trustworthy elections
A formal framework for specifying and analyzing logs as electronic evidence

SBMF'10 Proceedings of the 13th Brazilian conference on Formal methods: foundations and applications
A systematic process-model-based approach for synthesizing attacks and evaluating them

EVT/WOTE'12 Proceedings of the 2012 international conference on Electronic Voting Technology/Workshop on Trustworthy Elections
Distress detection (poster abstract)

RAID'12 Proceedings of the 15th international conference on Research in Attacks, Intrusions, and Defenses

Quantified Score

Hi-index	0.00

Visualization

Abstract

The existing solutions in the field of computer forensics are largely ad hoc. This paper discusses the need for a rigorous model of forensics and outlines qualities that such a model should possess. It presents an overview of a forensic model and an example of how to apply the model to a real-world, multi-stage attack. We show how using the model can result in forensic analysis requiring a much smaller amount of carefully selected, highly useful data than without the model.