CREATING INTEGRATED EVIDENCE GRAPHS FOR NETWORK FORENSICS

被引：0

作者：

Liu, Changwei ^{[1
]}

Singhal, Anoop ^{[2
]}

Wijesekera, Duminda ^{[1
]}

机构：

[1] George Mason Univ, Fairfax, VA 22030 USA

[2] Natl Inst Stand & Technol, Comp Secur Div, Gaithersburg, MD 20899 USA

来源：

ADVANCES IN DIGITAL FORENSICS IX | 2013年 / 410卷

关键词：

Network forensics; probabilistic evidence graphs; attack graphs; ATTACK; GENERATION;

D O I：

暂无

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Probabilistic evidence graphs can be used to model network intrusion evidence and the underlying dependencies to support network forensic analysis. The graphs provide a means for linking the probabilities associated with different attack paths with the available evidence. However, current work focused on evidence graphs assumes that all the available evidence can be expressed using a single, small evidence graph. This paper presents an algorithm for merging evidence graphs with or without a corresponding attack graph. The application of the algorithm to a file server and database server attack scenario yields an integrated evidence graph that shows the global scope of the attack. The global graph provides a broader context and better understandability than multiple local evidence graphs.

引用

页码：227 / 241

页数：15

共 13 条

[1] [Anonymous], 2011, Technical Report NIST Interagency Report 7788
[2] [Anonymous], PROC 5 INT WORKSH
[3] [Anonymous], 2002, P 9 ACM C COMP COMM, DOI DOI 10.1145/586110.586140
[4] Cormen TH., 2009, Introduction to Algorithms, V3
[5] Practical attack graph generation for network defense
Ingols, Kyle
Lippmann, Richard
Piwowarski, Keith
[J]. 22ND ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE, PROCEEDINGS, 2006, : 121 - +
[6] Two formal analyses of attack graphs
Jha, S
Sheyner, O
Wing, J
[J]. 15TH IEEE COMPUTER SECURITY FOUNDATION WORKSHOP, PROCEEDINGS, 2002, : 49 - 63
[7] Liu CW, 2012, IEEE INT WORKS INFOR, P121, DOI 10.1109/WIFS.2012.6412636
[8] Mehta V, 2006, LECT NOTES COMPUT SC, V4219, P127
[9] National Institute of Standards and Technology, NAT VULN DAT VERS 2
[10] Ou X., 2006, P 13 ACM C COMPUTER, P336, DOI DOI 10.1145/1180405.1180446

← 1 2 →