Signature based detection of user events for post-mortem forensic analysis

Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST

Volumn 53, Issue , 2011, Pages 96-109

  James, Joshua Isaac ^a   Gladyshev, Pavel ^a   Zhu, Yuandong ^a  

^a UNIVERSITY COLLEGE DUBLIN   (Ireland)

Author keywords

Digital forensics; Event reconstruction; Investigator inference; Signature detection; User actions; User events

Indexed keywords

DIGITAL FORENSIC; EVENT RECONSTRUCTION; INVESTIGATOR INFERENCE; SIGNATURE DETECTION; USER ACTION; USER EVENTS;

CRIME; ELECTRONIC CRIME COUNTERMEASURES;

COMPUTER FORENSICS;

EID: 84885873215     PISSN: 18678211     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-3-642-19513-6_8     Document Type: Conference Paper

References (17)

1. Gladyshev, P., Patel, A.: Formalising Event Time Bounding in Digital Investigations. International Journal of Digital Evidence 4 (2005)
2. Haggerty, J., Taylor, M.: FORSIGS: Forensic Signature Analysis of the Hard Drive for Multimedia File Fingerprints. In: IFIP International Federation for Information Processing, vol. 232, pp. 1-12 (2007)
3. James, J.: Survey of Evidence and Forensic Tool Usage in Digital Investigations (July 23,2010), The UCD Centre for Cybercrime Investigation, http://cci.ucd.ie/content/survey-evidence-and-forensic-toolusage-digital-investigations (July 26, 2010)
4. Kahvedzic, D., Kechadi, T.: Extraction of user activity through comparison of windows restore points. In: 6th Australian Digital Forensics Conference (2008)
5. Kim, D.H., In, D.H.: Cyber Criminal Activity Analysis Models using Markov Chain for Digital Forensics. In: ISA, pp. 193-198 (2008)
6. McAfee. Complete Security: The Case for Combined Behavioral and Signature-Based Protection. Whitepaper. Santa Carla: McAfee Inc. (2005)
7. Mukkamala, S., Sung, A.H.: Identifying Significant Features for Network Forensic Analysis Using Artificial Intelligent Techniques. International Journal of Digital Evidence 1.4 (2003)
8. Ogawa, A., Yamazaki, Y., Ueno, K., Cheng, K., Iriki, A.: Neural Correlates of Speciestypical Illogical Cognitive Bias in Human Inference. Journal of Cognitive Neuroscience, Massachusetts Institute of Technology (2009), doi:10.1162/jocn.2009.21330
9. Personage, H.: The Meaning of (L)inkfiles (I)n (F)orensic (E)xaminations (November 2009). Computer Forensics Miscellany, http://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf (Febuary 2, 2010)
10. Roiter, N.: When signature based antivirus isn't enough (May 3, 2007), http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1253602,00.html (Febuary 2, 2010)
11. Russinovich, M.: Inside the Registry (Feburary 3, 2010), http://technet.microsoft.com/enus/library/cc750583.aspx
12. Scarfone, K., Mell, P.: Guide to Intrusion Detection and Prevention Systems (IDPS) SP800-94. Special Publication. NIST: National Institute of Science and Technology. National Institute of Science and Technology, Gaithersburg (2007)
13. Sy, B.K.: Signature-Based Approach for Intrusion Detection. Machine Learning and Data Mining in Pattern Recognition, 526-536 (August 8, 2005)
14. Willassen, S.Y.: Timestamp evidence correlation by model based clock hypothesis testing. In: Proceedings of the 1st International Conference on Forensic Applications and Techniques in Telecommunications, Information, and Multimedia and Workshop, ICST, Brussels, Belgium, pp. 1-6 (2008)
15. Zhu, Y., James, J., Gladyshev, P.: A comparative methodology for the reconstruction of digital events using Windows Restore Points. Digital Investigation (2009a), doi:10.1016/j.diin.2009.02.004
16. Zhu, Y., James, J., Gladyshev, P.: Consistency Study of the Windows Registry. In: Sixth Annual IFIP WG 11.9 International Conference on Digital Forensics (2010)
17. Zhu, Y., Gladyshev, P., James, J.: Using ShellBag Information to Reconstruct User Activities. Digital Investigation 6, 69-77 (2009c), doi:10.1016/j.diin.2009.06.009