Modelagem de um Sistema Automatizado de Análise Forense: Arquitetura Extensível e Protótipo Inicial

• Marcelo Abdalla dos Reis UNICAMP
• Paulo Lício de Geus UNICAMP

DOI: https://doi.org/10.5753/sbseg.2002.21275

Abstract

The forensic analysis of a hacked computer system totally depends on the investigator's experience. However, part of his knowledge can be transfered to an automatic system through techniques applied in intrusion detection. In this sense, the authors of this paper propose a design model for an automatic forensic system capable of identifying and correlating intrusion evidences, presenting its architecture and an early prototype.

Keywords: security, computer forensics, information gathering, evidence correlation

References

Ross Anderson e Abida Khattak. The use of information retrieval techniques for intrusion detection. Em First Workshop on the Recent Advances in Intrusion Detection, Louvain-la-Neuve, Belgium, Setembro de 1998.

Rebecca G. Bace. Intrusion Detection. Macmillan Technical Publishing, Indianapolis, IN, 2000.

The honeynet forensic challenge, 2000. Disponível online em agosto de 2001 na URL http://project.honeynet.org/challenge/.

T. Goan. A cop on the beat: Collecting and appraising intrusion evidence. Communications of ACM, Julho de 1999.

Marcelo A. Reis e Paulo L. Geus. Forense computacional: Procedimentos e padrões. Em Anais do SSI’2001: 3º Simpósio Segurança em Informática, São José dos Campos, SP, 2001.

Marcelo A. Reis, Fabrício S. Paula, Diego M. Fernandes, e Paulo L. Geus. A hybrid ids architecture based on the immune system. Em A ser publicado no Wseg2002: Workshop em Segurança de Sistemas Computacionais, Búzios, RJ, 2002.