Network Forensics

ABSTRACT

The dictionary defines forensics as "the use of science and technology to investigate and establish facts in criminal or civil courts of law." I am more interested, however, in the usage common in the computer world: using evidence remaining after an attack on a computer to determine how the attack was carried out and what the attacker did.

The standard approach to forensics is to see what can be retrieved after an attack has been made, but this leaves a lot to be desired. The first and most obvious problem is that successful attackers often go to great lengths to ensure that they cover their trails. The second is that unsuccessful attacks often go unnoticed, and even when they are noticed, little information is available to assist with diagnosis.

REFERENCES

• 1: 1. For more on the Slapper story, see my rant: Security: Why do I bother? O'Reilly Network; http:// www.oreillynet.com/pub/wlg/2004.
• 2: 2. The Coroner's Toolkit; see: http://www.porcupine.org/ forensics/tct.html.
• 3: 3. Scheidler, B. syslog-ng. http://www.balabit.com/ products/syslog_ng/.
• 4: 4. Bird, T., and Ranum, M. Loganalysis.org, http://www.loganalysis.org/.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Algorithms, Security