Creating Integrated Evidence Graphs for Network Forensics - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2013

Creating Integrated Evidence Graphs for Network Forensics

Résumé

Probabilistic evidence graphs can be used to model network intrusion evidence and the underlying dependencies to support network forensic analysis. The graphs provide a means for linking the probabilities associated with different attack paths with the available evidence. However, current work focused on evidence graphs assumes that all the available evidence can be expressed using a single, small evidence graph. This paper presents an algorithm for merging evidence graphs with or without a corresponding attack graph. The application of the algorithm to a file server and database server attack scenario yields an integrated evidence graph that shows the global scope of the attack. The global graph provides a broader context and better understandability than multiple local evidence graphs.
Fichier principal
Vignette du fichier
978-3-642-41148-9_16_Chapter.pdf (1.45 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01460608 , version 1 (07-02-2017)

Licence

Paternité

Identifiants

Citer

Changwei Liu, Anoop Singhal, Duminda Wijesekera. Creating Integrated Evidence Graphs for Network Forensics. 9th International Conference on Digital Forensics (DF), Jan 2013, Orlando, FL, United States. pp.227-241, ⟨10.1007/978-3-642-41148-9_16⟩. ⟨hal-01460608⟩
122 Consultations
129 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More