Advanced evidence collection and analysis of web browser activity

Oh, Junghoon; Lee, Seungbong; Lee, Sang-Jin

doi:10.1016/j.diin.2011.05.008

Cited by 88 publications

(30 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The existing HTTP GET request for a web service and the delay of these requests in the tor network are used for determining the timeline analysis of the user request. Oh et al proposed WEFA to identify the suspects by analyzing the activity of various web browser . They analyzed the suspect computer by retrieving the data such as cache, history, cookies, and download list by analyzing the number of visits of user, time, and frequency of access of the user and through accessing the keywords found in search engines.…”

Section: Related Workmentioning

confidence: 99%

Secure logging scheme for forensic analysis in cloud

Sree

Bhanu

2019

Concurrency and Computation

View full text Add to dashboard Cite

Summary Cloud computing has emerged as a prominent technology that provides reliable on‐demand cloud services to users. Among the various kind of attacks, Distributed Denial of Service (DDoS) attack is one of the major application layer attacks that target the resources and services running in the cloud. Due to the distributed nature of attacks or crimes in the cloud, the evidence are collected from various components such as the router, switches, hard disk, log traces, and virtual machines. An attacker may collude with the cloud provider or investigators to tamper the log files or by inserting false information or by deleting the malicious activity logs altogether by leaving no trace. Hence, security is the major concern in cloud wherein investigation of crimes and attacks are very difficult. Collecting logs from the cloud providers is very hard since many users share the same network resources and the investigators rely on the providers to access the information. Therefore, in order to preserve the confidentiality, integrity, and authentication of logs, secure logging scheme is proposed to preserve the logs for forensic investigation. This paper highlights the secure logging scheme by extracting the features from logs of all virtual machine instances by double encryption scheme and also deals the integrity of the logs using hashing and verifies the signatures using Bloom filter–based R tree (BR tree). Furthermore, the verification is performed using Shamir Secret Sharing (SSS) scheme, and it is responsible for sharing the secret (private) keys to all the three parties, ie, user, investigator, and cloud providers. It is inferred from the experimental results that the proposed scheme requires minimal log processing time, minimal verification time for inserting logs, stores logs in time, and space efficient manner and scalable than existing methods.

show abstract

Section: Related Workmentioning

confidence: 99%

Secure logging scheme for forensic analysis in cloud

Sree

Bhanu

2019

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…The IRT is indispensable to deal with the information security issues within the organizations. Incident notification and incident containment play a central role concerning the above statements [7,10,11,20]. The theme of the information security incident containment is to suspend the issue if the situation permits or try to alleviate the impacts of the one to a minimum scale.…”

Section: Introductionmentioning

confidence: 99%

The disclosure of evaporating digital trails respecting the combinations of Gmail and IE for pervasive multimedia

Chu¹,

Yin

Hsu³

et al. 2014

Multimed Tools Appl

View full text Add to dashboard Cite

Unquestionably, the proliferation of mobile devices has dominated the main streams in contemporary ubiquitous wireless networks. Unfortunately, the misappropriating of those state-of-the-art gadgets has resulted in unprecedented information security issues in next generation cyberspace security arena. This paper illustrates the essence of generic procedures to provide the probative digital evidences for a typical Gmail Chat session in connection with the IE browser under different scenarios. When the computer-related information security issues arise with regard to the company, the corporate information incident response team should be able to disclose and preserve the evaporating digital trails following the right procedures to avoid the volatile characteristics in their natures. Furthermore, the design of the experiments of the paper identifies four cases to demonstrate the feasibility, availability, reliability, and traceability among them, which are essential for the corporate information security staffs to seriously consider when mushrooming cyber crimes are unknowingly and hastily burgeoning in an unparalleled manner. The organizations might have to scrutinize the negligible digital trails with cognitive expertise instead of entirely relying on law enforcement Multimed Tools Appl agencies from the public sectors due to the time constraints as well as publicity concerns or the minor computing resource policy violation unwarily occurred by the employees accordingly.

show abstract

“…Remote wipe applications are now also included on many mobile devices so the judgement call of balancing the need to secure the network to prevent remote wipe codes being transmitted, with the possibility of acquiring data from either a protected drive or cloud based data, has never been more crucial. The publication, Understanding Internet Security [9] by BigPlanet, states that over 90% of internet users have spyware lurking on their computers without their knowledge, delivered by a number of different methods. Websites carrying malicious code account for a large majority of attacks in the form of adware or spyware.…”

Section: Internet Securitymentioning

confidence: 99%

Privacy Preserving Internet Browsers: Forensic Analysis of Browzar

Warren

El-Sheikh

Le-Khac

2017

Computer and Network Security Essentials

View full text Add to dashboard Cite

Abstract. With the advance of technology, Criminal Justice agencies are being confronted with an increased need to investigate crimes perpetuated partially or entirely over the Internet. These types of crime are known as cybercrimes. In order to conceal illegal online activity, criminals often use private browsing features or browsers designed to provide total browsing privacy. The use of private browsing is a common challenge faced in for example child exploitation investigations, which usually originate on the Internet. Although private browsing features are not designed specifically for criminal activity, they have become a valuable tool for criminals looking to conceal their online activity. As such, Technological Crime units often focus their forensic analysis on thoroughly examining the web history on a computer. Private browsing features and browsers often require a more in-depth, post mortem analysis. This often requires the use of multiple tools, as well as different forensic approaches to uncover incriminating evidence. This evidence may be required in a court of law, where analysts are often challenged both on their findings and on the tools and approaches used to recover evidence. However, there are very few research on evaluating of private browsing in terms of privacy preserving as well as forensic acquisition and analysis of privacy preserving internet browsers. Therefore in this chapter, we firstly review the private mode of popular internet browsers. Next, we describe the forensic acquisition and analysis of Browzar, a privacy preserving internet browser and compare it with other popular internet browsers.

show abstract

Advanced evidence collection and analysis of web browser activity

Cited by 88 publications

References 1 publication

Secure logging scheme for forensic analysis in cloud

Secure logging scheme for forensic analysis in cloud

The disclosure of evaporating digital trails respecting the combinations of Gmail and IE for pervasive multimedia

Privacy Preserving Internet Browsers: Forensic Analysis of Browzar

Contact Info

Product

Resources

About