A model of forensic analysis using goal-oriented logging

摘要: Forensic analysis is the process of understanding, re-creating, and analyzing arbitrary events that have previously occurred. It seeks to answer such questions as how an intrusion occurred, what attacker did during intrusion, effects attack were. Currently field computer forensics largely ad hoc. Data generally collected because applications log it for debugging purposes or someone thought be important. Practical forensic has traditionally traded off analyzability against amount data recorded. Recording less puts a smaller burden both on systems humans analyze them. Not recording enough leaves analysts drawing their conclusions based inference, rather than deduction. This dissertation presents model analysis, called Laocoon, designed determine necessary understand past events. The builds upon earlier used detection, requires/provides model. set qualities we believe good should possess. Those are in turn influenced by five principles analysis. We apply Laocoon examples, present results UNIX system. demonstrate can record amounts highly useful data, forcing choice between overwhelming small effectively useless.