We found a match
Your institution may have access to this item. Find your institution then sign in to continue.
- Title
Quality assurance evidence collection model for MSN forensics.
- Authors
Bo-Chao Cheng; Huan Chen; Ryh-Yuh Tseng
- Abstract
Instant Messaging (IM) applications have become an important tool for business and social communication. However, when using IM, individuals and companies expose themselves to many security threats. Collecting all available data and preserving the integrity of evidence is a challenging task to perform IM forensics. In particular, under resource constrained situations, a good evidence collection mechanism is required to provide effective event collection in a network environment with heavy traffic. The emphasis of this paper is on the development of an effective evidence collection control mechanism that achieves an optimal outcome with a reasonable forensic service requests acceptance ratio and tolerable level of data capture loss. In this paper, we propose an evidence collection control model used in network forensics, called Quality Assurance Evidence Collection (QAEC). QAEC dynamically adjusts the amount of data to be collected on an evidence flow according to the storage capacity level. QAEC is firstly modeled as the Continuous Time Markov Chain (CTMC) and is realized by a cost function that comprises both flow-level and packet-level components to reflect the efforts on the evidence reconstruction process. We also present a prototype system (known as the MSN-Shot) as a MSN forensic system which uses QAEC to select an appropriate evidence collection strategy to maximize the given cost function. With the numerical analysis and prototype results, this study confirmed that the QAEC model meets cost-effective requirements and provides a practical security solution and guarantees a high level of quality assurance for network forensics.
- Subjects
INSTANT messaging; COMPUTER crimes; CRIMINAL investigation; QUALITY assurance; COMPUTER network security; BUSINESS communication; MARKOV processes; COMPUTER network resources
- Publication
Journal of Intelligent Manufacturing, 2010, Vol 21, Issue 5, p613
- ISSN
0956-5515
- Publication type
Article
- DOI
10.1007/s10845-009-0241-6