Adding event reconstruction to a cloud forensic readiness
Download as PPTX, PDF0 likes511 views
This document discusses adding event reconstruction to a cloud forensic readiness model. It proposes enhancing the model to include event reconstruction, which examines evidence to identify what caused it and helps create hypotheses for digital forensic investigations. It outlines key aspects of event reconstruction, including posing questions about evidence properties and where/when items were created. The proposed enhanced cloud forensic readiness model incorporates a process for event reconstruction that uses similarity measures and distance functions to distinguish between events, predict their behavior, and discover their underlying structures based on their relationships.
![ER examines and analyses the evidence to identify why it has
its characteristics [Carrier & Spafford, 2004].
ER will pose the following questions:
Why Evidence has the properties
Where could they have come from?
When were they created?
This may help to create a hypothesis for a DFI
Reconstruction identifies events for which evidence exist to
support their occurrence.
What is Event Reconstruction](https://image.slidesharecdn.com/addingeventreconstructiontoacloudforensicreadiness-150529202413-lva1-app6891/85/Adding-event-reconstruction-to-a-cloud-forensic-readiness-3-320.jpg)
![ Forensic Readiness-Maximizing an environment’s
ability to collect credible Digital Evidence.
Minimizing the cost of forensic investigation during
incident response [Rowlingson, 2004]
ISO/IEC 27043-”occurs before incident detection”
A Cloud Forensic Readiness Model](https://image.slidesharecdn.com/addingeventreconstructiontoacloudforensicreadiness-150529202413-lva1-app6891/85/Adding-event-reconstruction-to-a-cloud-forensic-readiness-4-320.jpg)
![Similarity measure between events represented by
Minkowskis’ distance function
A,B-Events
p=1,2…to ∞ is [comparative metric for suitable distance
metric between events]
dMD-Is the distance metric for Minkowski Distance
Similarity Measure
),( BAd MD
pp n
i ii BA ||1
](https://image.slidesharecdn.com/addingeventreconstructiontoacloudforensicreadiness-150529202413-lva1-app6891/85/Adding-event-reconstruction-to-a-cloud-forensic-readiness-11-320.jpg)
Adding event reconstruction to a cloud forensic readiness
- 1. Adding Event Reconstruction to a Cloud Forensic Readiness Model Presenter: V.R Kebande Supervisor: Prof Hein.S. Venter University of Pretoria
- 2. What is the focus of Digital Investigations Currently? Searching for Digital Evidence Collection of Digital Evidence Examining the Properties of Collected Evidence. But why is that Evidence Really Evidence? Important Aspect: Need to Identify what CAUSED Evidence to have the properties it has. Introduction
- 3. ER examines and analyses the evidence to identify why it has its characteristics [Carrier & Spafford, 2004]. ER will pose the following questions: Why Evidence has the properties Where could they have come from? When were they created? This may help to create a hypothesis for a DFI Reconstruction identifies events for which evidence exist to support their occurrence. What is Event Reconstruction
- 4. Forensic Readiness-Maximizing an environment’s ability to collect credible Digital Evidence. Minimizing the cost of forensic investigation during incident response [Rowlingson, 2004] ISO/IEC 27043-”occurs before incident detection” A Cloud Forensic Readiness Model
- 5. Proactive Approach Retaining Critical Information Collecting appropriate Digital Evidence So, How can a Cloud be Forensically Ready?
- 6. High-level view of the Model
- 7. What is involved? Event reconstruction Event reconstruction Process High-level Process Detailed process Proposed Enhanced Cloud Forensic readiness Model
- 8. Enhanced Cloud Forensic Readiness Model
- 10. P S A1 A2 A3 An Wi Xi yi Znei (Clu_N) (Clu_N) (Clu_N) (Clu_N) Event search function
- 11. Similarity measure between events represented by Minkowskis’ distance function A,B-Events p=1,2…to ∞ is [comparative metric for suitable distance metric between events] dMD-Is the distance metric for Minkowski Distance Similarity Measure ),( BAd MD pp n i ii BA ||1
- 12. Event reconstruction based on the distance function help achieve the following: To be able to distinguish one event from the other Predict behaviour of events Distinguish one event from the other through focusing on the relationship between them Enables a discovery of the structure of events Using distance metric
- 13. The ECFR can still be extended. Conclusion