In this paper, a process model for digital investigations is defined using the theories and techniques from the physical investigation world. While digital investigations have recently become more common, physical investigations have existed for thousands of years and the experience from them can be applied to the digital world. This paper introduces the notion of a digital crime scene with its own witnesses, evidence, and events that can be investigated using the same model as a physical crime scene. The proposed model integrates the physical crime scene investigation with the digital crime scene investigation to identify a person who is responsible for the digital activity. The proposed model applies to both law enforcement and corporate investigations.

/pdf/getting-physical-with-the-digital-investigation-process-41m6pv7xfr.pdf

Getting Physical with the Digital Investigation Process

Digital Evidence and Computer Crime, Third Edition provides the knowledge necessary to uncover and use digital evidence effectively in any kind of investigation. The widely-adopted first and second editions introduced thousands of students to this field and helped them deal with digital evidence. This completely updated edition provides the introductory materials that new students require, and also expands on the material presented in previous editions to help students develop these skills. The textbook teaches how computer networks function, how they can be involved in crimes, and how they can be used as a source of evidence. Additionally, this third edition includes updated chapters dedicated to networked Windows, Unix, and Macintosh computers, and Personal Digital Assistants. Ancillary materials include an Instructor's Manual and PowerPoint slides. * Provides a thorough explanation of how computers & networks function, how they can be involved in crimes, and how they can be used as evidence * Features coverage of the abuse of computer networks and privacy and security issues on computer networks

Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet

https://dfrws.org/wp-content/uploads/2019/06/2004_USA_paper-a_hierarchical_objectives-based_framework_for_the_digital_investigations_process.pdf

A hierarchical, objectives-based framework for the digital investigations process

Marc Dacier's topic is: intrusion detection vs. detection of errors caused by intentionally malicious faults. Although research on intrusion detection has been carried out for more than two decades, it has recently received increased attention due to the success of the Internet. A recent survey conducted by the IBM Global Security Laboratory indicates that more than 20 intrusion-detection products are now available on the market, whereas two years ago there were only three. Despite this growth of product offerings, intrusion-detection solutions are still in their infancy. Not only is there a lack of understanding of what an intrusion really is, but also how it should be handled. Moreover, from a technical point of view, many critical issues remain unsolved.In this talk, Marc presents what has been done in the intrusion domain in the past, and highlights new research directions that need to be addressed. He will highlight the relationship between intrusion detection and fault tolerance, drawing on the body of knowledge that has been developed within the traditional dependability community, and noting the opportunities for these two communities to work together to solve this important problem.Sami Saydjari's topic is: the detection of novel, previously unseen attacks. Although intrusion detection is a field still in its infancy, two broad approaches have evolved: pattern-based detection and anomaly-based detection. Pattern-based detection, sometimes called misuse-based detection, relies on matching known patterns of attacks already suffered. Anomaly-based detection, on the other hand, relies on detecting behaviors that are abnormal with respect to some normal standard. An example is that of a masquerader trying to hide behind someone else's login; unless the masquerader is clever indeed, his activities will stand out as anomalous against a victim's profile of normal behavior. Anomaly-based detection techniques appear to hold the best hope of detecting new variants of attacks.Sami emphasizes that although there exist some low-level sensors that can detect known attacks, the research community must move quickly in learning how to detect novel attacks at much higher detection rates (state of the art is around 80%) while keeping the false positive rates very low (0.1% or better). Detecting novel attacks will require better anomaly detection algorithms. Achieving a 99.9% detection rate will require gaining a firm understanding of the "sweet spots" of various detection algorithms, as well as an understanding of how to fuse the results of the best of the best. There is also a need to better represent knowledge of attack patterns in a canonical form, to be able to share that knowledge across multiple detection tools, and to be able to judge tools on the basis of how effectively they use knowledge, as opposed to which tool can include the largest corpus of precompiled (pattern-based) knowledge into its on-line database.The session concludes with an open discussion of how research communities can work together to reduce undependability caused by intentionally malicious faults.

Intrusion Detection

https://www.digital-evidence.org/papers/dfrws_event.pdf

An Event-Based Digital Forensic Investigation Framework

Law enforcement is in a perpetual race with criminals in the application of digital technologies, and requires the development of tools to systematically search digital devices for pertinent evidence. Another part of this race, and perhaps more crucial, is the development of a methodology in digital forensics that encompasses the forensic analysis of all genres of digital crime scene investigations. This paper explores the development of the digital forensics process, compares and contrasts four particular forensic methodologies, and finally proposes an

/pdf/an-examination-of-digital-forensic-models-e8ekki609z.pdf

An Examination of Digital Forensic Models

Trust management is a form of access control that uses delegation to achieve scalability beyond a single organization or federation. However, delegation can be difficult to control. A resource owner that delegates some authority is naturally concerned not only about who has access today, but also who will have access after others make changes to the global policy state. They need tools to help answer such questions. This problem has been studied in the case of a trust management language called RT. where, for simple questions concerning specific individuals, polynomial time algorithms are known. However, more useful questions, like "Could anyone who is not an employee ever get access?" are in general intractable. This paper concerns our efforts to build practical tools that answer such questions in many cases nevertheless by using a lightweight approach that leverages a mature model checking tool called SMV. Model checking is an automated technique that checks if desired properties hold in the model. Our experience, reported here, suggests that in our problem domain, such a tool may often be able to identify delegations that are unsafe with respect to security questions like the one mentioned above. We explain our translation from a RT policy and containment query to an SMV model and specification as well as demonstrate the feasibility of our approach with a case study.

Apply Model Checking to Security Analysis in Trust Management

Security in software is often considered a nonfunctional requirement because it is often interpreted as an emergent feature of the system. Too often it is introduced as a last- minute requirement over an otherwise completed product rather than properly integrated during the early stages of software design and development. One significant aspect of security involves access control. This paper proposes a multi-layer model detailing the integration of trust management access control with an application's model behavior. Our previous work focused on modeling the dynamic changes of a trust management policy for the purpose of verifying security properties using model checking. We are working toward integrating both the trust management policy and the mechanisms that enforce that policy for the purpose of verifying security properties. We focus on the Role-based Trust Management (RT) language and suggest concerns specific to it.

Engineering Trust Management into Software Models

The Air Force is shifting its cybersecurity paradigm from an information technology (IT)-centric toward a mission oriented approach. Instead of focusing on how to defend its IT infrastructure, it seeks to provide mission assurance by defending mission relevant cyber terrain enabling mission execution in a contested environment. In order to actively defend a mission in cyberspace, efforts must be taken to understand and document that mission's dependence on cyberspace and cyber assets. This is known as cyber terrain mission mapping. This paper seeks to define mission mapping and overview methodologies. We also analyze current tools seeking to provide cyber situational awareness through mission mapping or cyber dependency impact analysis and identify existing shortfalls.

Cyber terrain mission mapping: Tools and methodologies

Trust management is a scalable and flexible form of access control that relies heavily on delegation techniques. While these techniques may be necessary in large or decentralized systems, stakeholders need an analysis methodology and automated tools for reasoning about who will have access to their resources today as well as in the future. When an access control policy fails to satisfy the policy author's security objectives, tools should provide information that demonstrate how and why the failure occurred. Such information is useful in that it may assist policy authors in constructing policies that satisfy security objectives, which support policy authoring and maintenance. This paper presents a collection of reduction, optimization, and verification techniques useful in determining whether security properties are satisfied by RT policies. We provide proofs of correctness as well as demonstrate the degree of effectiveness and efficiency the techniques provide through empirical evaluation. While the type of analysis problem we examine is generally intractable, we demonstrate that our reduction and optimization techniques may be able to reduce problem instances into a form that can be automatically verified.

Mark Reith

Papers

An Examination of Digital Forensic Models

Apply Model Checking to Security Analysis in Trust Management

Engineering Trust Management into Software Models

Cyber terrain mission mapping: Tools and methodologies

Toward practical analysis for trust management policy