Network forensics analysis with evidence graphs (demo proposal)

Digital Forensic Research Workshop 2005

Volumn , Issue , 2005, Pages

  Wang, Wei ^a   Daniels, Thomas E ^a  

^a Iowa State University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANALYSIS TOOLS; ATTACK SCENARIOS; AUTOMATED REASONING; AUTOMATED REASONING PROCESS; EVIDENCE ANALYSIS; EVIDENCE GRAPH; GRAPH MODEL; HIERARCHICAL REASONING; LOCAL REASONING; NETWORK FORENSICS; RULE-BASED FUZZY COGNITIVE MAPS; STATE EVOLUTIONS;

ELECTRONIC CRIME COUNTERMEASURES;

AUTOMATA THEORY;

EID: 84868384221     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (24)

1. Steven M. Bellovin. Internet draft: ICMP traceback messages. Available at http://www.ietf.org/internet-drafts/draft-bellovin-itrace-00.txt, March 2000.
2. J. P. Carvalho and J. A. B. Tome. Rule Based Fuzzy Cognitive Maps: Fuzzy Causal Relations. In Proceedings of the 8th International Fuzzy Systems Association World Congress(IFSA99), Taiwan, 1999.
3. F. Cuppens. Managing alerts in a multi-intrusion detecttion environment. In Proceedings of the 17th Annual Computer Security Applications Conference(ACSAC), 2001.
4. F. Cuppens and A. Miege. Alert Correlation in a Cooperative Intrusion Detection Framework. In Proceedings of the 2002 IEEE Symposium on Security and Privacy, May 2002.
5. O. Dain and R. Cunningham. Building scenarios from a heterogeneous alert stream. In Proceedings of the 2001 IEEE workshop on Information Assurance and Security, pages 231-235, 2001.
6. O. Dain and R. Cunningham. Fusing a heterogeneous alert stream into scenarios. In Proceedings of the 2001 ACM workshop on Data Mining for Security Applications, pages 231-235, 2001.
7. Thomas E. Daniels. Reference Models for the Concealment and Observation of Origin Identity in Store-and-Forward Networks. PhD thesis, Purdue University, West Lafayette,Indiana, 2002.
8. Drew Dean, Matt Franklin, and Adam Stubblefield. An algebraic approach to ip traceback. In Proceedings of 2001 Network and Distributed Systems Security Symposium, pages 3-12, San Diego, California, February 2001.
9. H. Debar, M. Dacer, and A. Wespi. A revised taxonomy for intrusiondetection systems. In IBM Research Report, 1999.
10. Herve Debar and Andreas Wespi. Aggregation and Correlation of Intrusion-Detection Alerts. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection(RAID), October 2001.
11. S. Eckmann, G. Vigna, and R. Kemmerer. Statl: An attack language for state-based intrusion detection. Dept. of Computer Science, University of California, Santa Barbara., 2000.
12. Institute for Security Technology Studies. Law enforcement tools and technologies for investigating cyber attacks: Gap analysis report. http://www.ists.dartmouth.edu, February 2004.
13. K. Julisch. Mining alarm clusters to improve alarm handling efficiency. In Proceedings of the 17th Annual Computer Security Applications Conference(ACSAC), pages 12-21, 2001.
14. K. Julisch. Clustering intrusion detection alarms to support root cause analysis. In ACM Transactions on Information and System Security, pages 443-471, Nov 2003.
15. B. Morin and H. Debar. Correlation of intrusion symptoms: an application of chronicles. In Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection(RAID'03), 2003.
16. Benjamin Morin, Ludovic Me, Herve Debar, and Mireille Ducasse. M2D2: A Formal Data Model for IDS Alert Correlation. In Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection, pages 115-137, 2002.
17. P. Ning, Y. Cui, and D. S. Reeves. Constructing attack scenarios through correlation of intrusion alerts. In 9th ACM Conference on Computer and Communicaitons Security, November 2002.
18. P. Ning and D. Xu. Learning attack stratagies from intrusion alerts. In Proceedings of the 10th ACM Conference on Computer and Communicaitons Security, 200-209, 2003. (Pubitemid 40673802)
19. Alex C. Snoeren, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Beverly Schwartz, Stephen T. Kent, and W. Timothy Strayer. Single-packet ip traceback. IEEE/ACM Trans. Netw., 10(6):721-734, 2002.
20. A. Valdes and K. Skinner. Probablistic alert correlation. In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection(RAID), October 2001.
21. Wei Wang and Thomas E. Daniels. Building evidence graphs for network forensics analysis. Submitted to 21st Annual Computer Security Applications Conference(ACSAC'05).
22. X. Wang and D. S. Reeves. Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays. In Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS 2003), Washington DC, USA, Oct. 2003.
23. K. Yoda and H. Etoh. Finding a connection chain for tracing intruders. In Proceedings of the 6th European Symposium on Research in Computer Security (ESORICS 2000), Toulouse, France, Oct. 2000.
24. Y. Zhang and V. Paxson. Detecting stepping stones. In Proceedings of the 9th USENIX Security Symposium, pages 171-184, Denver, USA, Aug. 2000.