Principles-driven forensic analysis

Proceedings New Security Paradigms Workshop

Volumn 2006, Issue , 2006, Pages 85-93

  Peisert, Sean ^a   Bishop, Matt ^b   Karin, Sidney ^a   Marzullo, Keith ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Abstraction shortcuts; Auditing; Compilers; Covert channels; Forensic analysis; Forensic principles; Forensics; Logging; Multi resolution forensics; Race conditions; Virtual machine introspection

Indexed keywords

ABSTRACTION SHORTCUTS; AUDITING; COMPILERS; COVERT CHANNELS; FORENSIC ANALYSIS; FORENSIC PRINCIPLES; FORENSICS; LOGGING; MULTI-RESOLUTION FORENSICS; VIRTUAL MACHINE INTROSPECTION;

ABSTRACTING; COMPUTER OPERATING SYSTEMS; DATA ACQUISITION; HAZARDS AND RACE CONDITIONS; MATHEMATICAL MODELS; RESOURCE ALLOCATION;

COMPUTER SYSTEMS;

EID: 33745615461     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (19)

1. J. P. Anderson. Computer security threat monitoring and surveillance. Technical report, James P. Anderson Co., Fort Washington, PA, April, 1980.
2. M. Bishop. Computer Security: Art and Science. Addison-Wesley Professional, Boston, MA, 2003.
3. M. Bishop. The Insider Problem Revisited. In Proceedings of the 2005 New Security Paradigms Workshop (NSPW), 2005.
4. G. W. Dunlap, S. T. King, S. Cinar, M. A. Basrai, and P. M. Chen. ReVirt: Enabling intrusion analysis through virtual-machine logging and replay. In Proceedings of the 2002 Symposium on Operating Systems Design and Implementation, 2002.
5. D. Engler, D. Y. Chen, S. Hallem, A. Chou, and B. Chelf. Bugs as deviant behavior: A general approach to inferring errors in systems code. In Proceedings of the Symposium on Operating Systems Principles, 2001.
6. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proceedings of the 2003 Network and Distributed System Security Symposium, 2003.
7. D. P. Gilliam, T. L. Wolfe, J. S. Sherif, and M. Bishop. Software security checklist for the software life cycle. In Proceedings of the Twelfth IEEE International Workshop on Enabling Technologies: Infrastructure for Colaborative Enterprises (WETICE'03), 2003.
8. A. H. Gross. Analyzing Computer Intrusions. PhD thesis, University of California, San Diego, 1997.
9. S. T. King and P. M. Chen. Backtracking intrusions. ACM Transactions on Computer Systems, 23(1):51-76, February 2005.
10. S. T. King, G. W. Dunlap, and P. M. Chen. Plato: A platform for virtual machine services. Technical Report CSE-TR-498-04, University of Michigan, 2004.
11. B. A. Kuperman. A Categorization of Computer Security Monitoring Systems and the Impact on the Design of Audit Sources. PhD thesis, Purdue University, 2004.
12. B. W. Lampson. A note on the confinement problem. Communications of the ACM, 16(10):613-615, October 1973.
13. S. Peisert. Forensics for System Administrators. ;login:, August 2005.
14. N. L. Petroni, Jr., T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In Proceedings of the 2005 USENIX Security Symposium, 2005.
15. T. Stallard and K. Levitt. Automated analysis for digital forensic science: Semantic integrity checking. In Proceedings of the 19th Annual Computer Security Applications Conference, December 8-12 2003.
16. Sun Microsystems, Inc. Auditing in the Solaris™ Operating Environment, February 2001.
17. S. J. Templeton and K. Levitt. A Requires/Provides model for computer attacks. In Proceedings of the 2000 New Security Paradigms Workshop, pages 31-38, 2000.
18. K. Thompson. Reflections on Trusting Trust. Communications of the ACM, 27(8):761-763, August 1984.
19. M. Xu, R. Bodik, and M. D. Hill. A "Flight Data Recorder" for enabling full-system multiprocessor deterministic replay. In Proceedings of the 30th annual international symposium on Computer architecture, 2003.