Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Adding event reconstruction to a cloud forensic readiness


Published on

Presentation at the ICSA Lab

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Adding event reconstruction to a cloud forensic readiness

  1. 1. Adding Event Reconstruction to a Cloud Forensic Readiness Model Presenter: V.R Kebande Supervisor: Prof Hein.S. Venter University of Pretoria
  2. 2. What is the focus of Digital Investigations Currently?  Searching for Digital Evidence  Collection of Digital Evidence  Examining the Properties of Collected Evidence. But why is that Evidence Really Evidence? Important Aspect: Need to Identify what CAUSED Evidence to have the properties it has. Introduction
  3. 3. ER examines and analyses the evidence to identify why it has its characteristics [Carrier & Spafford, 2004]. ER will pose the following questions:  Why Evidence has the properties  Where could they have come from?  When were they created? This may help to create a hypothesis for a DFI Reconstruction identifies events for which evidence exist to support their occurrence. What is Event Reconstruction
  4. 4.  Forensic Readiness-Maximizing an environment’s ability to collect credible Digital Evidence.  Minimizing the cost of forensic investigation during incident response [Rowlingson, 2004]  ISO/IEC 27043-”occurs before incident detection” A Cloud Forensic Readiness Model
  5. 5.  Proactive Approach  Retaining Critical Information  Collecting appropriate Digital Evidence So, How can a Cloud be Forensically Ready?
  6. 6. High-level view of the Model
  7. 7.  What is involved? Event reconstruction Event reconstruction Process  High-level Process  Detailed process Proposed Enhanced Cloud Forensic readiness Model
  8. 8. Enhanced Cloud Forensic Readiness Model
  9. 9. Reconstruction Reconstruction Process
  10. 10. P S A1 A2 A3 An Wi Xi yi Znei (Clu_N) (Clu_N) (Clu_N) (Clu_N) Event search function
  11. 11. Similarity measure between events represented by Minkowskis’ distance function A,B-Events p=1,2…to ∞ is [comparative metric for suitable distance metric between events] dMD-Is the distance metric for Minkowski Distance Similarity Measure ),( BAd MD pp n i ii BA ||1  
  12. 12. Event reconstruction based on the distance function help achieve the following:  To be able to distinguish one event from the other  Predict behaviour of events  Distinguish one event from the other through focusing on the relationship between them  Enables a discovery of the structure of events Using distance metric
  13. 13.  The ECFR can still be extended. Conclusion