A Log-Structured Block Preservation and Restoration System for Proactive Forensic Data Collection in the Cloud

Hirano, Manabu; Ogawa, Hideoki

doi:10.1109/ares.2016.8

Cited by 3 publications

(2 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…POSTER, 16 which is based on Microsoft Azure, can be flexibly scaled to adapt to the increase or decrease of forensics targets to conduct active forensics. Manabu Hirano 17 proposes the use of a log‐structured block database to actively collect cloud data evidence to monitor all write operations on the virtual block device.…”

Section: Related Workmentioning

confidence: 99%

TamForen: A tamper‐proof cloud forensic framework

Zheng

Xiao

et al. 2020

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Cloud forensics has become increasingly critical in cloud computing security in recent years. A fundamental problem in cloud forensics is how to safely and effectively obtain, preserve, and analyze evidence. With massive cloud forensic systems and tools having been proposed over the years, we identify one challenge that is not adequately addressed in the current literature. The problem is “credibility of cloud evidence”; this is where the evidence collected in the cloud is unreliable due to its multitenancy and the multiple participants in the forensic process. In this paper, we develop a new Cloud Forensics Tamper‐Proof Framework (TamForen) for cloud forensics, which can be used in an untrusted and multitenancy cloud environment. This framework relies on the cloud forensics system independent of the daily cloud activities and is implemented based on the Multilayer Compressed Counting Bloom Filter. Unlike existing cloud forensics methods that depend on the support and trust of cloud service providers, TamForen takes into account the untrustworthiness of participants in the forensics process and conducts tamper‐proof protection of data in a decentralized way without violating users' privacy. We simulate a cloud forensics environment to evaluate TamForen, and the results show that TamForen is feasible.

show abstract

Section: Related Workmentioning

confidence: 99%

TamForen: A tamper‐proof cloud forensic framework

Zheng

Xiao

et al. 2020

Trans Emerging Tel Tech

View full text Add to dashboard Cite

show abstract

“…1 National Institute of Technology, Toyota College, 2-1 Eisei, 471-8525 Toyota, Japan. 2 Kogakuin University, 1-24-2 Nishi-shinjuku, Shinjuku-ku, 163-8677 Tokyo, Japan.…”

Section: Availability Of Data and Materialsmentioning

confidence: 99%

LogDrive: a proactive data collection and analysis framework for time-traveling forensic investigation in IaaS cloud environments

et al. 2018

Self Cite

View full text Add to dashboard Cite

This paper presents the LogDrive framework for mitigating the following problems of storage forensics in Infrastructure-as-a-Service (IaaS) cloud environments: volatility, increasing volume of forensic data, and anti-forensic attacks that hide traces of incidents in virtual machines. The proposed proactive data collection function of virtual block devices mitigates the problem of volatility within the cloud environments and enables a time-traveling investigation to reveal overwritten or deleted evidence files. We employ a sector-hash-based file detection method with random sampling to search for an evidence file in the record of the write logs of the virtual storage. The problem formulation, the investigation context, and the design with five algorithms are presented. We explore the performance of LogDrive through a detailed evaluation. Finally, security analysis of LogDrive is presented based on the STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege) threats model and related work. We posted the source code of LogDrive on GitHub.

show abstract