Cloud computing digital forensics framework for automated anomalies detection

Abstract

Cloud Computing is one of the most important paradigms used in today's digital environment because they offer to the user benefits such as virtual machine renting, digital information backup, ease of access to stored data and many other. Together with the increased usage of these technologies, at the datacenter level we need to know in detail the information flux between the computing nodes. More exactly, on which server the data is processed, how it is manipulated and stored at the physical or virtual level. To have a full picture of what it is going on we need to have a centralized system that can collect data regarding about the datacenters status and correlate them with known anomalies and other usage patterns and in case of a security breach to act accordingly.In this paper we present a new way to monitor running virtual machines existing at a datacenter level. We will talk about the architecture, and how we use the information collected to train our automated anomalies machine learning modules. We also present some implementation details and results taken from the experimental setup.

Enhancements in the world of digital forensics

“…To separate the relevance evidence in the information layer, voting-k-means approach is used. Deep learning techniques will be applied in future research in the cloud computing environment for digital forensics to enhance clustering [19], [20].…”

A framework for cloud forensics evidence collection and analysis using security information and event management

“…A number of research projects are in progress with the aim to overcome cloud forensic challenges. A framework has been presented for the automated detection of anomalies in a cloud environment . Architecture‐level changes are performed, and a module for cloud forensics, which is capable of learning malicious activities, is embedded in the management layer of the cloud infrastructure.…”