LEIA: The Live Evidence Information Aggregator: Towards efficient cyber-law enforcement

Homem, Irvin; Dosis, Spyridon; Popov, Oliver

doi:10.1109/worldcis.2013.6751038

Cited by 6 publications

(10 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We outline the requirements of such a P2P system for DFIR purposes, considering both structure d and unstructured P2P overlays. Finally, we propose improvements for the LEIA architecture [22] using ideas from [23,24,25,26,27] and [28], that would enable the distribution of information in such a network, thus enabling a more effective system for performing digital forensics and incident response in a collaborative manner in loosely controlled network environments.…”

Section: Contributionmentioning

confidence: 99%

“…All of these innovative ideas are premised on the grounds of a controlled network environment such as that in an enterprise. To the best of our knowledge, there has been only one study [22] that provides for DFIR architectures for less controlled environments, encompassing the digital forensics process model. This study mainly makes use of 2 P2P overlays to enable automation of some parts of the digital forensics process model, but still relies on a centralized backend for data storage and analysis.…”

Section: Digital Forensics and Incident Response In Networked Environmentioning

confidence: 99%

“…The distribution of this context information with DHT -based structured overlays as the underlying platform has been addressed with DCXP [26,27] and the KBR API [90]. We make use of these ideas of sharing context information and combine the strengths of various other structured, unstructured and hybrid P2P overlays in order to apply them for specific uses to enhance our digital forensics and incident response system [22] that previously maintained a centralized backend. In this way we organize the underlying network in a more efficient manner to support further decentralization and automation of the digital investigation process within loosely controlled networked environments.…”

Section: Resource Placement and Lookupmentioning

confidence: 99%

“…Digital investigations today in such environments also have to deal with these same large amounts of data being created , transmitted or stored among these heterogeneous devices. [33] The architecture in [22] proposed a centrally controlled scalable distributed filesystem as a backend for capturing and processing large amounts of digital evidence from devices in a loosely controlled network environment. Thus, we need to consider the factors that would play a part in achieving a further distributed system that can provide digital investigation services among large amounts of data and devices in an independent and automated manner devoid of a centrally controlled infrastructure.…”

Section: Distributed Systems and "Big Data" Concernsmentioning

confidence: 99%

“…The system architecture is based on the functional needs and requirements as identified and discussed in previous sections of this study. The main focus is directed towards the use of various P2P overlays within the system, while also making reference to prior work of the LEIA architecture [22], as well as incorporating the use of the DCXP protocol [26][27] to manage the information distributed by the structured overlays.…”

Section: An Architecture For Dfir In Loosely Controlled Environmentsmentioning

confidence: 99%

See 4 more Smart Citations

Improving Distributed Forensics and Incident Response in Loosely Controlled Networked Environments

Homem¹,

Kanter²,

Rahmani³

2016

IJSIA

Self Cite

View full text Add to dashboard Cite

show abstract

Section: Contributionmentioning

confidence: 99%

Section: Digital Forensics and Incident Response In Networked Environmentioning

confidence: 99%

Section: Resource Placement and Lookupmentioning

confidence: 99%

Section: Distributed Systems and "Big Data" Concernsmentioning

confidence: 99%

Section: An Architecture For Dfir In Loosely Controlled Environmentsmentioning

confidence: 99%

See 3 more Smart Citations

Improving Distributed Forensics and Incident Response in Loosely Controlled Networked Environments

Homem¹,

Kanter²,

Rahmani³

2016

IJSIA

Self Cite

View full text Add to dashboard Cite

show abstract

Biometrically Linking Document Leakage to the Individuals Responsible

Alruban

Clarke

et al. 2018

Trust, Privacy and Security in Digital Business

View full text Add to dashboard Cite

Insider threats are a significant security issue. The last decade has witnessed countless instances of data loss and exposure in which data has become publicly available and easily accessible. Losing or disclosing sensitive data or confidential information may cause substantial financial and reputational damage to a company. Whilst more recent research has specifically focused on the insider misuse problem, it has tended to focus on the information itselfeither through its protection or approaches to detect leakage. In contrast, this paper presents a proactive approach to the attribution of misuse via information leakage using biometrics and a locality-sensitive hashing scheme. The hash digest of the object (e.g. a document) is mapped with the given biometric information of the person who interacted with it and generates a digital imprint file that represents the correlation between the two parties. The proposed approach does not directly store or preserve any explicit biometric information nor document copy in a repository. It is only the established correlation (imprint) is kept for the purpose of reconstructing the mapped information once an incident occurred. Comprehensive experiments for the proposed approach have shown that it is highly possible to establish this correlation even when the original version has undergone significant file modification. In many scenarios, such as changing the file format r removing parts of the document, including words and sentences, it was possible to extract and reconstruct the correlated biometric information out of a modified document (e.g. 100 words were deleted) with an average success rate of 89.31%.

show abstract

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

McKeown

Russell

Leimich

2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

Cloud based storage is increasing in popularity, with large volumes of data being stored remotely. Digital forensics investigators examining such systems remotely are limited by bandwidth constraints when accessing this kind of data using traditional tools. This paper explores the potential for sub-file hashing strategies to decrease the time taken to detect contraband on networked storage devices, while maintaining a high degree of accuracy. Results show that sub-file hashing is faster than full file hashing for both LAN and Internet server configurations, with reduced bandwidth heavily favouring sub-file strategies.

show abstract

LEIA: The Live Evidence Information Aggregator: Towards efficient cyber-law enforcement

Cited by 6 publications

References 17 publications

Improving Distributed Forensics and Incident Response in Loosely Controlled Networked Environments

Improving Distributed Forensics and Incident Response in Loosely Controlled Networked Environments

Biometrically Linking Document Leakage to the Individuals Responsible

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

Contact Info

Product

Resources

About