Automated recognition of event scenarios for digital forensics

Proceedings of the ACM Symposium on Applied Computing

Volumn 1, Issue , 2006, Pages 293-300

  Abbott, Jonathon ^a   Bell, Jim ^b   Clark, Andrew ^a   De Vel, Olivier ^b   Mohay, George ^a  

^a QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

^b DEFENCE SCIENCE AND TECHNOLOGY ORGANISATION   (Australia)

Author keywords

Computer forensics; Event correlation; Events; Heterogeneous event logs; Logs

Indexed keywords

COMPUTER CRIME; COMPUTER SOFTWARE; DATABASE SYSTEMS; QUERY LANGUAGES;

COMPUTER FORENSICS; EVENT CORRELATION; EVENTS; HETEROGENEOUS EVENT LOGS; LOGS;

PATTERN RECOGNITION;

EID: 33751045850     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1141277.1141346     Document Type: Conference Paper

References (12)

1. Chen Kevin, Andrew Clark, Olivier De Vel and George Mohay "ECF - Event Correlation for Forensics" In Proceedings of 1st Australian Computer, Network & Information Forensics Conference Perth, Western Australia, 2003.
2. NetForensics, "NetForensics," http://www.netforensics.com/, 2003.
3. GuardedNet, "GuardedNet neuSECURE," http://www.guarded.net/, 2003.
4. e-Security Inc., "e-Security Management System," http://www.esecurityinc.com/, 2003.
5. GFI Software USA, "LANguard Security Event Log Monitor," http://www.gfisoftware.de/, 2003.
6. Sawmill, "Flowerfire," www.sawmill.net, 2003.
7. TNT Software, "ELM Log Manager," https://www.tnttechnology.com/ , 2003.
8. I3P - Institute for Information Infrastructure Protection, "National Information Infrastructure Protection Research and Development Agenda Initiative Report, Information Infrastructure Protection: Survey of Products, Tools and Services," http://www.thei3p.org, 9 Sept 2002.
9. Haines Joshua, Dorene Kewley Ryder, Laura Tinnel, Stephen Taylor, "Validation of Sensor Alert Correlators," IEEE Security & Privacy, vol. 1, 2003.
10. Bishop M. "A Standard Audit Trail Format" In Proceedings of 18th National Information Systems Security Conference, 1995. pp. 136-145.
11. CERIAS, "Audit Trails Format Group," http://www.cerias.purdue. edu/about/history/coast/projects/audit-trails-format.php: Purdue University, 2003.
12. CERIAS Audit Trail Reduction Group, http://www.cerias.purdue.edu/about/ history/coast/projects/audit-trails-reduce.php: Purdue University, 2003.