Principles-Driven Forensic Analysis
Citation
- S. Peisert, M. Bishop, S. Karin, and K. Marzullo,
“Principles-Driven Forensic Analysis,”
Proceedings of the 2005 New Security Paradigms Workshop
pp. 85–93 (Sep. 2005).
Paper
PDF (free, goes to the ACM Digital Library)
Bibliographic Information
Abstract
It is possible to enhance our understanding of what has happened
on a computer system by using forensic techniques
that do not require prediction of the nature of the attack, the
skill of the attacker, or the details of the system resources or
objects affected. These techniques address five fundamental
principles of computer forensics. These principles include
recording data about the entire operating system, particularly
user space events and environments, and interpreting
events at different layers of abstraction, aided by the context
in which they occurred. They also deal with modeling the
recorded data as a multi-resolution, finite state machine so
that results can be established to a high degree of certainty
rather than merely inferred.
