We found a match
Your institution may have access to this item. Find your institution then sign in to continue.
- Title
LogDrive: a proactive data collection and analysis framework for time-traveling forensic investigation in IaaS cloud environments.
- Authors
Hirano, Manabu; Tsuzuki, Natsuki; Ikeda, Seishiro; Kobayashi, Ryotaro
- Abstract
This paper presents the LogDrive framework for mitigating the following problems of storage forensics in Infrastructure-as-a-Service (IaaS) cloud environments: volatility, increasing volume of forensic data, and anti-forensic attacks that hide traces of incidents in virtual machines. The proposed proactive data collection function of virtual block devices mitigates the problem of volatility within the cloud environments and enables a time-traveling investigation to reveal overwritten or deleted evidence files. We employ a sector-hash-based file detection method with random sampling to search for an evidence file in the record of the write logs of the virtual storage. The problem formulation, the investigation context, and the design with five algorithms are presented. We explore the performance of LogDrive through a detailed evaluation. Finally, security analysis of LogDrive is presented based on the STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege) threats model and related work. We posted the source code of LogDrive on GitHub.
- Subjects
ACQUISITION of data; SURVEILLANCE detection; FORENSIC sciences; VIRTUAL machine systems; PERFORMANCE evaluation
- Publication
Journal of Cloud Computing (2192-113X), 2018, Vol 7, Issue 1, p1
- ISSN
2192-113X
- Publication type
Article
- DOI
10.1186/s13677-018-0119-2