Login | Register

Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence

Title:

Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence

Mokhov, Serguei A., Paquet, Joey and Debbabi, Mourad (2010) Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence. In: Jha, S. and Sommer, R. and Kreibich, C., (eds.) Recent Advances in Intrusion Detection. Lecture Notes in Computer Science, 6307 . Springer, pp. 508-509. ISBN 978-3-642-15511-6

[thumbnail of Version submitted for publication.]
Preview
Text (Version submitted for publication.) (application/pdf)
flucid-raid2010.pdf - Submitted Version
138kB

Official URL: http://dx.doi.org/10.1007/978-3-642-15512-3_36

Abstract

We apply the theoretical framework and formal model of the observation tuple with the credibility weight for forensic analysis of the IDS data and the corresponding event reconstruction. Forensic Lucid - a forensic case modeling and specification language is used for the task. In the ongoing theoretical and practicalwork, Forensic Lucid is augmented with the Dempster-Shafer theory of mathematical evidence to include the credibility factors of the evidential IDS observations. Forensic Lucid's toolset is practically being implemented within the General Intensional Programming System (GIPSY) and the probabilisticmodel-checking tool PRISM as a backend to compile the Forensic Lucid model into the PRISM’s code and model-check it. This work may also help with further generalization of the testing methodology of IDSs.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Computer Science and Software Engineering
Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Concordia University > Research Units > Computer Security Laboratory
Item Type:Book Section
Refereed:Yes
Authors:Mokhov, Serguei A. and Paquet, Joey and Debbabi, Mourad
Editors:Jha, S. and Sommer, R. and Kreibich, C.
Journal or Publication:Lecture Notes in Computer Science
Series Name:Lecture Notes in Computer Science
Date:2010
Projects:
  • Forensic Lucid
  • General Intensional Programming System (GIPSY)
Funders:
  • Faculty of Engineering and Computer Science, Concordia University, Montreal
  • NSERC
Digital Object Identifier (DOI):10.1007/978-3-642-15512-3_36
Keywords:Forensic Lucid, intrusion detection, IDS, theory of mathematical evidence
ID Code:15117
Deposited By: Serguei Mokhov
Deposited On:30 Sep 2011 15:08
Last Modified:18 Jan 2018 17:35

References:

Arasteh, A.R., Debbabi, M., Sakha, A., Saleh, M.: Analyzing multiple logs for forensic evidence. Digital Investigation Journal 4(1), 82–91 (2007)

Ashcroft, E.A., Faustini, A., Jagannathan, R., Wadge, W.W.: Multidimensional, Declarative Programming. Oxford University Press, London (1995)

Gladyshev, P., Patel, A.: Finite state machine approach to digital event reconstruction. Digital Investigation Journal 2(1) (2004)

Haenni, R., Kohlas, J., Lehmann, N.: Probabilistic argumentation systems. Tech. rep., Institute of Informatics, University of Fribourg, Fribourg, Switzerland (October 1999)

Mokhov, S.A.: Encoding forensic multimedia evidence from MARF applications as Forensic Lucid expressions. In: CISSE 2008, pp. 413–416. Springer, Heidelberg (December 2008)

Mokhov, S.A.: Towards syntax and semantics of hierarchical contexts in multimedia processing applications using MARFL. In: COMPSAC, pp. 1288–1294. IEEE CS, Los Alamitos (2008)

Mokhov, S.A., Paquet, J., Debbabi, M.: Formally specifying operational semantics and language constructs of Forensic Lucid. In: IMF 2008, pp. 197–216. GI (September 2008)

Mokhov, S.A., Paquet, J., Debbabi, M.: Reasoning about a simulated printer case investigation with Forensic Lucid. In: ICDF2C 2011. Springer (Abstract presented in HSC 2009, October 2009, SCS) (to appear)

Mokhov, S.A., Vassev, E.: Self-forensics through case studies of small to medium software systems. In: IMF 2009, pp. 128–141. IEEE CS, Los Alamitos (2009)

Otrok, H., Paquet, J., Debbabi, M., Bhattacharya, P.: Testing intrusion detection systems in MANET: A comprehensive study. In: CNSR 2007, pp. 364–371. IEEE CS, Los Alamitos (2007)

Paquet, J., Mokhov, S.A., Tong, X.: Design and implementation of context calculus in the GIPSY environment. In: COMPSAC 2008, pp. 1278–1283. IEEE CS, Los Alamitos (2008)

Shafer, G.: The Mathematical Theory of Evidence. Princeton University Press, Princeton (1976)

Wan, K.: Lucx: Lucid Enriched with Context. Ph.D. thesis, Department of Computer Science and Software Engineering, Concordia University, Montreal, Canada (2006)
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Research related to the current document (at the CORE website)
- Research related to the current document (at the CORE website)
Back to top Back to top