Cloud forensics: Evidence collection and preliminary analysis

Abstract

Digital evidence needs to be made persistent so that it can be used later. For citizen forensics, sometimes intelligence cannot or should not be made persistent forever. In this position paper, we propose a form of snap forensics by defining an elastic duration of evidence/intelligence validity. Explicitly declaring such a duration could unify the treatment of both ephemeral intelligence and persistent evidence towards more flexible storage to satisfy privacy requirements. CCS CONCEPTS • Security and privacy → Privacy protections; KEYWORDS digital forensics, privacy requirements ACM Reference format:

SIV: a structural integrity verification approach of cloud components with enhanced privacy

“…For example, Khan et al [2] discussed using existing forensic techniques with cloud logs to identify malicious behaviors by attackers. Saibharath and Geethakumari [3] collected virtual machine disk images, logs, etc., to make a similar analysis. Tan et al [4] collected information on the dynamic running environment, including memory, processes, CPU, network ports, disk files, and configuration data to prepare for further trustworthiness evaluation.…”

“…There are two crucial points in the process of integrity verification: the expression and checking of integrity proofs, and the protection from tampering of these proofs in storage and transmission. Many researchers have sought the clearest and most accurate forms of proof that can describe the integrity status of an object; for example, raw logs/records [2] , test reports [3] , process contexts [4] , properties [5] , and Platform Configuration Registers (PCRs) [6] . Forms of raw proof, such as records and reports, can provide a solid basis for integrity verification, but present the risk of leaking private data.…”

SAAS: Attack Detection and Prevention with Forensic in cloud environment

“…During this letter we tend to examine the legal aspects of the digital forensic investigation of the cloud computing system. System [2] proposed the cloud automatic data processing system hosts most of today's industrial business applications, which provides it high revenue that makes it the target of cyber attacks.Here the necessity for a digital rhetorical system for the cloud surroundings is seen. According to [3] Cloud computing is the computing paradigm which modify getting resources like code, hardware, services over the net.…”

A framework for cloud forensics evidence collection and analysis using security information and event management

“…Architecture‐level changes are performed, and a module for cloud forensics, which is capable of learning malicious activities, is embedded in the management layer of the cloud infrastructure. Similarly, a mechanism that uses the Struts and Hadoop distributed file system for forensic data collection and rendering in a cloud environment has been proposed and implemented . Virtual machine disk images and logs are collected using a pull model, by an investigator, and network captures are pushed periodically to the Struts and Hadoop distributed file system, which is later used for forensic analysis.…”