Finite state machine approach to digital event reconstruction

Abstract

This paper presents a rigorous method for reconstructing events in digital systems. It is based on the idea, that once the system is described as a finite state machine, its state space can be explored to determine all possible scenarios of the incident. To formalize evidence, the evidential statement notation is introduced. It represents the facts conveyed by the evidence as a series of witness stories that restrict possible computations of the finite state machine. To automate event reconstruction, a generic event reconstruction algorithm is proposed. It computes the set of all possible explanations for the given evidential statement with respect to the given finite state machine.

Event reconstruction using temporal pattern of file system modification

“…The event reconstruction method in [20] describes the compromised system as a finite state machine (FSM). Then, in order to determine all possible scenarios of the incident, it backtraces transitions from the state in which the system was discovered.…”

“…Correlationbased event reconstruction methods try to find some correlations among low-level pieces of evidence. Moreover, there are some miscellaneous event reconstruction methods in the literature [6,9,10,[20][21][22].…”

SoK

“…Event reconstruction in digital forensics has been defined in terms of finite state machines by Gladyshev and Patel [40]. However, it less formally refers to a process that can "convert the state of the [digital] objects into the events that caused the state" [17].…”

Software Engineering Challenges for Investigating Cyber-Physical Incidents

“…Gladyshev and Patel [16] propose a finite state machine (FSM) approach to formalize hypothesis generation of an incident in digital investigations. Formalization is done through defining the event reconstruction problem as finding all possible explanations for a given evidential statement with respect to the FSM.…”