Breadcrumb

 
 

Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence

Title:

Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence

Mokhov, Serguei A. and Paquet, Joey and Debbabi, Mourad (2010) Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence. In: Recent Advances in Intrusion Detection. Lecture Notes in Computer Science, 6307 . Springer, pp. 508-509. ISBN 978-3-642-15511-6

[img]
Preview
PDF (Version submitted for publication.) - Submitted Version
135Kb

Official URL: http://dx.doi.org/10.1007/978-3-642-15512-3_36

Abstract

We apply the theoretical framework and formal model of the observation tuple with the credibility weight for forensic analysis of the IDS data and the corresponding event reconstruction. Forensic Lucid - a forensic case modeling and specification language is used for the task. In the ongoing theoretical and practicalwork, Forensic Lucid is augmented with the Dempster-Shafer theory of mathematical evidence to include the credibility factors of the evidential IDS observations. Forensic Lucid's toolset is practically being implemented within the General Intensional Programming System (GIPSY) and the probabilisticmodel-checking tool PRISM as a backend to compile the Forensic Lucid model into the PRISM’s code and model-check it. This work may also help with further generalization of the testing methodology of IDSs.

Divisions:Concordia University > Faculty of Engineering and Computer Science > Computer Science and Software Engineering
Concordia University > Faculty of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Concordia University > Research Units > Computer Security Laboratory
Item Type:Book Section
Refereed:Yes
Authors:Mokhov, Serguei A. and Paquet, Joey and Debbabi, Mourad
Journal or Publication: Lecture Notes in Computer Science
Series Name:Lecture Notes in Computer Science
Date:2010
Projects:
  • Forensic Lucid
  • General Intensional Programming System (GIPSY)
Funders:
  • Faculty of Engineering and Computer Science, Concordia University, Montreal
  • NSERC
Keywords:Forensic Lucid, intrusion detection, IDS, theory of mathematical evidence
ID Code:15117
Deposited By:Serguei Mokhov
Deposited On:30 Sep 2011 11:08
Last Modified:30 Sep 2011 11:08
References:
Arasteh, A.R., Debbabi, M., Sakha, A., Saleh, M.: Analyzing multiple logs for forensic evidence. Digital Investigation Journal 4(1), 82–91 (2007)

Ashcroft, E.A., Faustini, A., Jagannathan, R., Wadge, W.W.: Multidimensional, Declarative Programming. Oxford University Press, London (1995)

Gladyshev, P., Patel, A.: Finite state machine approach to digital event reconstruction. Digital Investigation Journal 2(1) (2004)

Haenni, R., Kohlas, J., Lehmann, N.: Probabilistic argumentation systems. Tech. rep., Institute of Informatics, University of Fribourg, Fribourg, Switzerland (October 1999)

Mokhov, S.A.: Encoding forensic multimedia evidence from MARF applications as Forensic Lucid expressions. In: CISSE 2008, pp. 413–416. Springer, Heidelberg (December 2008)

Mokhov, S.A.: Towards syntax and semantics of hierarchical contexts in multimedia processing applications using MARFL. In: COMPSAC, pp. 1288–1294. IEEE CS, Los Alamitos (2008)

Mokhov, S.A., Paquet, J., Debbabi, M.: Formally specifying operational semantics and language constructs of Forensic Lucid. In: IMF 2008, pp. 197–216. GI (September 2008)

Mokhov, S.A., Paquet, J., Debbabi, M.: Reasoning about a simulated printer case investigation with Forensic Lucid. In: ICDF2C 2011. Springer (Abstract presented in HSC 2009, October 2009, SCS) (to appear)

Mokhov, S.A., Vassev, E.: Self-forensics through case studies of small to medium software systems. In: IMF 2009, pp. 128–141. IEEE CS, Los Alamitos (2009)

Otrok, H., Paquet, J., Debbabi, M., Bhattacharya, P.: Testing intrusion detection systems in MANET: A comprehensive study. In: CNSR 2007, pp. 364–371. IEEE CS, Los Alamitos (2007)

Paquet, J., Mokhov, S.A., Tong, X.: Design and implementation of context calculus in the GIPSY environment. In: COMPSAC 2008, pp. 1278–1283. IEEE CS, Los Alamitos (2008)

Shafer, G.: The Mathematical Theory of Evidence. Princeton University Press, Princeton (1976)

Wan, K.: Lucx: Lucid Enriched with Context. Ph.D. thesis, Department of Computer Science and Software Engineering, Concordia University, Montreal, Canada (2006)
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Document Downloads

More statistics for this item...

Concordia University - Footer