A Graph Based Approach Toward Network Forensics Analysis

Abstract

In this article we develop a novel graph-based approach toward network forensics analysis. Central to our approach is the evidence graph model that facilitates evidence presentation and automated reasoning. Based on the evidence graph, we propose a hierarchical reasoning framework that consists of two levels. Local reasoning aims to infer the functional states of network entities from local observations. Global reasoning aims to identify important entities from the graph structure and extract groups of densely correlated participants in the attack scenario. This article also presents a framework for interactive hypothesis testing, which helps to identify the attacker's nonexplicit attack activities from secondary evidence. We developed a prototype system that implements the techniques discussed. Experimental results on various attack datasets demonstrate that our analysis mechanism achieves good coverage and accuracy in attack group and scenario extraction with less dependence on hard-coded expert knowledge.

Relating Admissibility Standards for Digital Evidence to Attack Scenario Reconstruction

“…The formalized definition can be found in (Wang, and Thomas, 2008;Liu, Singhal, and Wijesekera, 2013). The following is the one defined in Liu, Singhal and Wijesekera.…”

“…p(e)=c(e) × w(e) × r(e) × h(e), where "w", "r" and "h" are weight, relevancy and the importance of an evidence edge "e" (Wang, W., and Thomas, E.D., 2008). "c" is the category of evidence, including primary evidence, secondary evidence and hypothesis testing based on expert knowledge.…”

“…also demonstrated how to use this Bayesian probability assignment model by applying the model to a digital forensics legal case from Hong Kong Police Department, in which the defendant used his computer to distribute a pirated movie on the Internet by using BitTorrent (Magistrates' Court at Tuen Mun). Wang and Thomas (2008) use fuzzy-logic based correlation to find the causality relationship between different evidence, which constructs the attack scenario in a graph form. Fuzzy logic does not learn membership rules during or after problem solving.…”

“…In order to use IDS alerts as evidence, many have proposed aggregating redundant alerts and correlating them to determine multi-step, multi-stage attacks (Dain and Cunningham, 2001;Debar and Wespi, 2001;Wang and Thomas, 2008). While such aggregation can help in reconstructing a multi-stage, multi-step attack scenario, to the best of our knowledge, none of this work has been integrated with legal acceptability standards of evidence.…”

Attack Graph Analysis for Network Anti-Forensics

“…Numerous tutorials are available on internet which provide handful of information about hacking and data theft (Kotenko & Stepashkin, 2006). Another area is the incorporation of anti-forensics such as data hiding, hiding IP, network steganography, data destruction, obfuscation and log cleaning into attacks to hinder the investigation (W. Wang & Daniels, 2008). One of the key drawbacks of network forensics is that they fail to prove the adequacy and integrity of gathered evidence (W. Wang & Daniels, 2008).…”