FACE: Automated digital evidence discovery and correlation

Case, Andrew; Cristina, Andrew; Marziale, Lodovico; Richard, Golden G.; Roussev, Vassil

doi:10.1016/j.diin.2008.05.008

Cited by 85 publications

(47 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, forensics investigation on inside activities in healthcare enterprise environment, including incident detection and reconstruction is critically needed (Tu et al, 2012). Current research on inside threat detection and identification (Eberle & Holder, 2009;Moore, Cappelli, & Trzeciak, 2008;Phua, Lee, Smith, & Gayler, 2007) and event reconstruction mechanisms (Case et al, 2008;Tang, & Daniels, 2005;Tu et al, 2012) are limited in real world since they require a comprehensive set of information including social information and explicit dependence knowledge, which are not available in an enterprise environment. Hence, a novel mechanisms are critical to identify potential inside activity and reconstruct the inside activity for tracking.…”

Section: Insider Activity Identification and Trackingmentioning

confidence: 99%

Data Loss Prevention Management and Control: Inside Activity Incident Monitoring, Identification, and Tracking in Healthcare Enterprise Environments

Tu¹

2015

JDFSL

View full text Add to dashboard Cite

As healthcare data are pushed online, consumers have raised big concerns on the breach of their personal information. Law and regulations have placed businesses and organizations under obligations to take actions to prevent data breach. Among various threats, insider threats have been identified as a major threat on data loss. Thus, effective mechanisms to control insider threats on data loss are urgently needed. The objective of this research is to address data loss prevention challenges in healthcare enterprise environment. First, a novel approach is provided to model internal threat, specifically inside activities. With inside activities modeling, data loss paths and threat vectors are formally described and identified. Then, threat vectors and potential data loss paths have been investigated in a healthcare enterprise environment. Threat vectors have been enumerated and data loss statistics data for some threat vectors have been collected. After that, issues on data loss prevention and inside activity incident identification, tracking, and reconstruction are discussed. Finally, evidences of inside activities are modeled as evidence trees to provide guidance for inside activity identification, tracking, and reconstruction.

show abstract

Section: Insider Activity Identification and Trackingmentioning

confidence: 99%

Data Loss Prevention Management and Control: Inside Activity Incident Monitoring, Identification, and Tracking in Healthcare Enterprise Environments

Tu¹

2015

JDFSL

View full text Add to dashboard Cite

show abstract

“…The second type of analysis performed is anomaly detection. It works by defining parameters for normal activity for a given set of resources [17,18]. This defined normal activity becomes a baseline against which all activity is measured.…”

Section: Bridge Between Ids Outputs and Df Evidencementioning

confidence: 99%

Obtaining Digital Evidence from Intrusion Detection Systems

MoyoAchille¹,

Roger²

2014

IJCA

View full text Add to dashboard Cite

Intrusion detection techniques have appeared to inspect all of the inbound and outbound network activities, and to identify suspicious patterns that indicate an attack that might compromise an information system. However, related information can be collected so as to supply evidence in criminal and civil legal proceedings. Several works have been carried out in the domain of Intrusion Detection and Prevention System (IDPS) but, none of the resulting models taking into account the possibility to collect intrusion related information in such a way that some of it can be turned in evidence in a proactive digital forensic purpose. In the literature, some authors have mentioned the possibility of redesigning IDPS as sources of evidence but, a formal model has never been proposed. This paper proposes an intrusion detection architecture for digital forensic purposes implemented using SNORT program.

show abstract

“…Case et al [43] propose the FACE framework for performing automatic correlations in forensic investigation. However, the framework is structured to only consider static and known relations in data (for example, linking network socket in memory to TCP requests in packet capture) especially when signification case detail is available a priori.…”

Section: Correlation and Corroborationmentioning

confidence: 99%

Digital forensic research: current state of the art

Raghavan

2012

CSIT

115

View full text Add to dashboard Cite

Abstract-Digital Forensics is the process of employing scientific principles and processes analyze electronically stored information to determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse sources. In this paper, we review the research literature since 2000 and categorize developments in the field into 4 major categories. In recent years the exponential growth of technological has also brought with it some serious challenges for digital forensic research which is elucidated. Within each category, research is sub-classified into conceptual and practical advancements. We highlight the observations made by previous researchers and summarize the research directions for the future.

show abstract

FACE: Automated digital evidence discovery and correlation

Cited by 85 publications

References 8 publications

Data Loss Prevention Management and Control: Inside Activity Incident Monitoring, Identification, and Tracking in Healthcare Enterprise Environments

Data Loss Prevention Management and Control: Inside Activity Incident Monitoring, Identification, and Tracking in Healthcare Enterprise Environments

Obtaining Digital Evidence from Intrusion Detection Systems

Digital forensic research: current state of the art

Contact Info

Product

Resources

About