Formal Digital Investigation of Anti-forensic Attacks

Rekhis, Slim; Boudriga, Noureddine

doi:10.1109/sadfe.2010.9

Cited by 13 publications

(12 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One of the main problems that hinder the digital investigation is that, the investigators fail to evaluate whether the evidence gathered are adequate to prove events of the crime, detect any anti-forensics attacks and to lighten these effects on the compromised evidence (Rekhis & Boudriga, 2010b).…”

Section: Background and Motivationmentioning

confidence: 99%

“…For example, once the attacker had succeeded in compromising a system, the first step carried out is to delete the traces of occurred events. Anti-forensics techniques are carried out to reduce the qualitative and quantitative substantial evidence (Baier & Breitinger, 2011) on the compromised systems (Hilley, 2007;Kessler, 2007;Rekhis & Boudriga, 2010b). As the technology advances, new anti-forensic tools and techniques has been discovered and implemented.…”

Section: Background and Motivationmentioning

confidence: 99%

“…In order to achieve these goals, there are various tools and techniques are introduced (Caloyannides, 2009;Cao, Zhao, Ni, & Tian, 2010;Forte & Power, 2007;Harris, 2006;Rekhis & Boudriga, 2010b;Sartin, 2006;Shanmugam et al, 2011). The sub-sections below details the techniques used for anti-forensics.…”

Section: Fundamentals Of Anti-forensic Techniquesmentioning

confidence: 99%

“…Renaming the file is one example of incriminating the data by hiding. Encryption, watermarking, covert cannels (Rekhis & Boudriga, 2010b) and steganography are the main techniques used to obscure the network traffic and data. It should be made sure that while encrypting and using covert channels the data or information should not be lost.…”

Section: Data Hidingmentioning

confidence: 99%

“…It can be successfully achieved by modification of metadata, anonymization techniques such as IP spoofing, MAC Spoofing, VPNs and proxies and covering the trace of evidence. Digital forensic investigators can be misled by the attacker by false email header generation, log alteration and SMTP proxies (Rekhis & Boudriga, 2010a). Timestamp alteration and modification of headers is another form of trail obfuscation.…”

Section: Data/trail Obfuscationmentioning

confidence: 99%

See 4 more Smart Citations

Attack Graph Analysis for Network Anti-Forensics

Chandran

Yan

2014

International Journal of Digital Crime and Forensics

View full text Add to dashboard Cite

The development of technology in computer networks has boosted the percentage of cyber-attacks today. Hackers are now able to penetrate even the strongest IDS and firewalls. With the help of anti-forensic techniques, attackers defend themselves, from being tracked by destroying and distorting evidences. To detect and prevent network attacks, the main modus of operandi in network forensics is the successful implementation and analysis of attack graph from gathered evidences. This paper conveys the main concepts of attack graphs, requirements for modeling and implementation of graphs. It also contributes the aspect of incorporation of anti-forensic techniques in attack graph which will help in analysis of the diverse possibilities of attack path deviations and thus aids in recommendation of various defense strategies for better security. To the best of our knowledge, this is the first time network anti-forensics has been fully discussed and the attack graphs are employed to analyze the network attacks. The experimental analysis of anti-forensic techniques using attack graphs were conducted in the proposed test-bed which helped to evaluate the model proposed and suggests preventive measures for the improvement of security of the networks.

show abstract

Section: Background and Motivationmentioning

confidence: 99%

Section: Background and Motivationmentioning

confidence: 99%

Section: Fundamentals Of Anti-forensic Techniquesmentioning

confidence: 99%

Section: Data Hidingmentioning

confidence: 99%

Section: Data/trail Obfuscationmentioning

confidence: 99%

See 3 more Smart Citations

Attack Graph Analysis for Network Anti-Forensics

Chandran

Yan

2014

International Journal of Digital Crime and Forensics

View full text Add to dashboard Cite

show abstract

Intrusion detection and tolerance: A global scheme

Djemaiel

Rekhis

Boudriga

2007

Int J Communication

Self Cite

View full text Add to dashboard Cite

SUMMARYProtecting implemented security mechanisms and trusting their output (e.g. log files) when the host, under which they are deployed, is compromised, is among the major challenges that have to be faced. To fulfil this need, recent advances in security have considered the design of storage-based intrusion detection system, which detect intrusions by looking at the low-level disk requests patterns. However, these systems neither tolerate intrusions, nor do they distinguish whether the disk requests are generated by legitimate or malicious processes; and consequently, they generate a lot of false negative and positive alerts. In this paper, we present a Cooperative Intrusion Detection and Tolerance System, called CIDTS, which takes advantage of the information that are available at the network, host operating system, and storage level to better detect intrusion attempts in their early stages, even when the host is compromised. To allow cooperation, the disk communication interface that transports requests between the storage level and the host level is extended to forward information about the processes that generate the request. The paper also provides intrusion tolerance capabilities and provides techniques to support investigation activities.

show abstract

A Survey on Digital Forensics Phases, Tools and Challenges

Mohammmed¹,

Sridevi

2020

Proceedings of the Third International Conference on Computational Intelligence and Informatics

View full text Add to dashboard Cite

Formal Digital Investigation of Anti-forensic Attacks

Cited by 13 publications

References 9 publications

Attack Graph Analysis for Network Anti-Forensics

Attack Graph Analysis for Network Anti-Forensics

Intrusion detection and tolerance: A global scheme

A Survey on Digital Forensics Phases, Tools and Challenges

Contact Info

Product

Resources

About