Building evidence graphs for network forensics analysis

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn 2005, Issue , 2005, Pages 254-264

  Wei, Wang ^a   Daniels, Thomas E ^a  

^a Iowa State University of Science and Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AUTOMATED REASONING; NETWORK FORENSICS ANALYSIS;

FEEDBACK; GRAPH THEORY; HIERARCHICAL SYSTEMS; PUBLIC KEY CRYPTOGRAPHY; SECURITY OF DATA;

COMPUTER NETWORKS;

EID: 33846310441     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSAC.2005.14     Document Type: Conference Paper

References (23)

1. LEDA graph library. Algorithmic Solutions Software, http://www. algorithmic-solutions.com/enleda.htm.
2. S. M. Bellovin. Internet draft: ICMP traceback messages. Available at http://www.ietf.org/internet-drafts/draft-bellovin-itrace-00.txt, March 2000.
3. J. P. Carvalho and J. A. B. Tome. Rule Based Fuzzy Cognitive Maps and Fuzzy Cognitive Maps - A Comparative Study. In Proceedings of the 18th International Conference of the North American Fuzzy Information Processing Society(NAFIPS99), New York, 1999.
4. J. P. Carvalho and J. A. B. Tome. Rule Based Fuzzy Cognitive Maps: Fuzzy Causal Relations. In Proceedings of the 8th International Fuzzy Systems Association World Congress(IFSA99), Taiwan, 1999.
5. F. Cuppens and A. Miege. Alert Correlation in a Cooperative Intrusion Detection Framework. In Proceedings of the 2002 IEEE Symposium on Security and Privacy, May 2002.
6. O. Dain and R. Cunningham. Building scenarios from a heterogeneous alert stream. In Proceedings of the 2001 IEEE workshop on Information Assurance and Security, pages 231-235, 2001.
7. O. Dain and R. Cunningham. Fusing a heterogeneous alert stream into scenarios. In Proceedings of the 2001 ACM workshop on Data Mining for Security Applications, pages 231-235, 2001.
8. T. E. Daniels. Reference Models for the Concealment and Observation of Origin Identity in Store-and-Forward Networks. PhD thesis, Purdue University, West Lafayette,Indiana, 2002.
9. H. Debar, M. Dacer, and A. Wespi. A revised taxonomy for intrusion-detection systems. In IBM Research Report, 1999.
10. H. Debar and A. Wespi. Aggregation and Correlation of Intrusion-Detection Alerts. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection(RAID), October 2001.
11. EnCase Forensic Tool. Available at http://www.guidancesoftware.com.
12. Intrusion Detection Message Exchange Format. Internet draft available at http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-14.txt.
13. Institute for Security Technology Studies. Law enforcement tools and technologies for investigating cyber attacks: Gap analysis report, http://www.ists.dartmouth.edu, February 2004.
14. C. Kruegel and W. Robertson. Alert Verification: Determing the success of intrusion attempts. In Proceedings of the 1st Workshop on the Detection of Intrusions and Malware Vulnerability Assessment (DIMVA), Dortmund, Germany, July. 2004.
15. B. Morin, L. Me, H. Debar, and M. Ducasse. M2D2: A Formal Data Model for IDS Alert Correlation. In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection, pages 115-137, 2002.
16. P. Ning, Y. Cui, and D. S. Reeves. Constructing attack scenarios through correlation of intrusion alerts. In 9th ACM Conference on Computer and Communicaitons Security, November 2002.
17. SafeBack Bit Stream Backup Software. Available at http://www.forensics- intl.com/safeback.html.
18. K. Shanmugasundaram, N. Memon, A. Savant, and H. Bronnimann. ForNet: A Distributed Forensics Network. In Proceedings of the Second International Workshop on Mathematical Methods, Models and Architectures for Computer Networks Security, St. Petersburg, Russia, 2003.
19. A. Siraj, S. M.Bridges, and R. B.Vaughn. Fuzzy cognitive maps for decision support in an intelligent intrusion detection system. Technical report, Department of Computer Science, Mississippi State University, 2001.
20. A. C. Snoeren, C. Partridge, L. A. Sanchez, C. E. Jones, F. Tchakountio, B. Schwartz, S. T. Kent, and W. T. Strayer. Single-packet ip traceback. IEEE/ACM Trans. Netw., 10(6):721-734, 2002.
21. A. Valdes and K. Skinner. Probablistic alert correlation. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection(RAID), October 2001.
22. K. Yoda and H. Etoh. Finding a connection chain for tracing intruders. In Proceedings of the 6th European Symposium on Research in Computer Security (ESORICS 2000), Toulouse, France, Oct. 2000.
23. Y. Zhang and V. Paxson. Detecting stepping stones. In Proceedings of the 9th USENIX Security Symposium, pages 171-184, Denver, USA, Aug. 2000.