Mokhov, Serguei A., Paquet, Joey and Debbabi, Mourad (2010) Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence. In: Jha, S. and Sommer, R. and Kreibich, C., (eds.) Recent Advances in Intrusion Detection. Lecture Notes in Computer Science, 6307 . Springer, pp. 508-509. ISBN 978-3-642-15511-6
Preview |
Text (Version submitted for publication.) (application/pdf)
138kBflucid-raid2010.pdf - Submitted Version |
Official URL: http://dx.doi.org/10.1007/978-3-642-15512-3_36
Abstract
We apply the theoretical framework and formal model of the observation tuple with the credibility weight for forensic analysis of the IDS data and the corresponding event reconstruction. Forensic Lucid - a forensic case modeling and specification language is used for the task. In the ongoing theoretical and practicalwork, Forensic Lucid is augmented with the Dempster-Shafer theory of mathematical evidence to include the credibility factors of the evidential IDS observations. Forensic Lucid's toolset is practically being implemented within the General Intensional Programming System (GIPSY) and the probabilisticmodel-checking tool PRISM as a backend to compile the Forensic Lucid model into the PRISM’s code and model-check it. This work may also help with further generalization of the testing methodology of IDSs.
| Divisions: | Concordia University > Gina Cody School of Engineering and Computer Science > Computer Science and Software Engineering Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering Concordia University > Research Units > Computer Security Laboratory |
|---|---|
| Item Type: | Book Section |
| Refereed: | Yes |
| Authors: | Mokhov, Serguei A. and Paquet, Joey and Debbabi, Mourad |
| Editors: | Jha, S. and Sommer, R. and Kreibich, C. |
| Journal or Publication: | Lecture Notes in Computer Science |
| Series Name: | Lecture Notes in Computer Science |
| Date: | 2010 |
| Projects: |
|
| Funders: |
|
| Digital Object Identifier (DOI): | 10.1007/978-3-642-15512-3_36 |
| Keywords: | Forensic Lucid, intrusion detection, IDS, theory of mathematical evidence |
| ID Code: | 15117 |
| Deposited By: | Serguei Mokhov |
| Deposited On: | 30 Sep 2011 15:08 |
| Last Modified: | 18 Jan 2018 17:35 |
References:
Arasteh, A.R., Debbabi, M., Sakha, A., Saleh, M.: Analyzing multiple logs for forensic evidence. Digital Investigation Journal 4(1), 82–91 (2007)Ashcroft, E.A., Faustini, A., Jagannathan, R., Wadge, W.W.: Multidimensional, Declarative Programming. Oxford University Press, London (1995)
Gladyshev, P., Patel, A.: Finite state machine approach to digital event reconstruction. Digital Investigation Journal 2(1) (2004)
Haenni, R., Kohlas, J., Lehmann, N.: Probabilistic argumentation systems. Tech. rep., Institute of Informatics, University of Fribourg, Fribourg, Switzerland (October 1999)
Mokhov, S.A.: Encoding forensic multimedia evidence from MARF applications as Forensic Lucid expressions. In: CISSE 2008, pp. 413–416. Springer, Heidelberg (December 2008)
Mokhov, S.A.: Towards syntax and semantics of hierarchical contexts in multimedia processing applications using MARFL. In: COMPSAC, pp. 1288–1294. IEEE CS, Los Alamitos (2008)
Mokhov, S.A., Paquet, J., Debbabi, M.: Formally specifying operational semantics and language constructs of Forensic Lucid. In: IMF 2008, pp. 197–216. GI (September 2008)
Mokhov, S.A., Paquet, J., Debbabi, M.: Reasoning about a simulated printer case investigation with Forensic Lucid. In: ICDF2C 2011. Springer (Abstract presented in HSC 2009, October 2009, SCS) (to appear)
Mokhov, S.A., Vassev, E.: Self-forensics through case studies of small to medium software systems. In: IMF 2009, pp. 128–141. IEEE CS, Los Alamitos (2009)
Otrok, H., Paquet, J., Debbabi, M., Bhattacharya, P.: Testing intrusion detection systems in MANET: A comprehensive study. In: CNSR 2007, pp. 364–371. IEEE CS, Los Alamitos (2007)
Paquet, J., Mokhov, S.A., Tong, X.: Design and implementation of context calculus in the GIPSY environment. In: COMPSAC 2008, pp. 1278–1283. IEEE CS, Los Alamitos (2008)
Shafer, G.: The Mathematical Theory of Evidence. Princeton University Press, Princeton (1976)
Wan, K.: Lucx: Lucid Enriched with Context. Ph.D. thesis, Department of Computer Science and Software Engineering, Concordia University, Montreal, Canada (2006)
Repository Staff Only: item control page
Download Statistics
Download Statistics