Name
Abstract | ||
|---|---|---|
Attack graphs are used to compute potential attackpaths from a system configuration and known vulnerabilities of asystem. Attack graphs can be used to eliminate knownvulnerability sequences that can be eliminated to make attacksdifficult and help forensic examiners in identifying manypotential attack paths. After an attack happens, forensic analysis, including linking evidence with attacks, helps further understandand refine the attack scenario that was launched. Given thatthere are anti-forensic tools that can obfuscate, minimize oreliminate attack footprints, forensic analysis becomes harder. Asa solution, we propose to apply attack graph to forensic analysis. We do so by including anti-forensic capabilities into attackgraphs, so that the missing evidence can be explained by usinglonger attack paths that erase potential evidence. We show thiscapability in an explicit case study involving a database attack. |
Year | DOI | Venue |
|---|---|---|
2012 | 10.1109/ARES.2012.58 | ARES |
Keywords | Field | DocType |
system vulnerability,anti-forensics,oreliminate attack footprint,forensic analysis,antiforensic tools,forensic examinations,attack graphs,attack paths,usinglonger attack path,system configuration,attack scenario,computer forensics,potential evidence,forensic examiner,anti-forensics vulnerability database,attack graph,attack footprints,database attack,manypotential attack path,graph theory,missing evidence | Graph theory,Data mining,Computer forensics,Network forensics,Computer science,Computer security,System configuration,Obfuscation,Attack graph | Conference |
ISBN | Citations | PageRank |
978-1-4673-2244-7 | 9 | 0.68 |
References | Authors | |
5 | 3 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Changwei Liu | 1 | 41 | 6.92 |
| Anoop Singhal | 2 | 576 | 168.78 |
| Duminda Wijesekera | 3 | 1464 | 141.54 |