Toward Models for Forensic Analysis
Authors:
- 1 April 2007
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 3-15
Abstract
The existing solutions in the field of computer forensics are largely ad hoc. This paper discusses the need for a rigorous model of forensics and outlines qualities that such a model should possess. It presents an overview of a forensic model and an example of how to apply the model to a real-world, multi-stage attack. We show how using the model can result in forensic analysis requiring a much smaller amount of carefully selected, highly useful data than without the modelKeywords
This publication has 10 references indexed in Scilit:
- Analysis of Computer Intrusions Using Sequences of Function CallsIEEE Transactions on Dependable and Secure Computing, 2007
- Modeling network intrusion detection alerts for correlationACM Transactions on Information and System Security, 2007
- Forensic Analysis of File System Intrusions Using Improved Backtracking2005
- Backtracking intrusionsACM Transactions on Computer Systems, 2005
- Forensix: a robust, high-performance reconstruction system2005
- Principles-driven forensic analysis2005
- With microscope and tweezers: an analysis of the Internet virus of November 19882003
- A requires/provides model for computer attacks2001
- Enforceable security policiesACM Transactions on Information and System Security, 2000
- Intrusion detection systems as evidenceComputer Networks, 1999