Abstract The integrity of any original evidence is fundamental to a forensic examination. Preserving the integrity of digital evidence is vitally important as changing just one bit among perhaps gigabits of data, will irrevocably alter that data and cast doubt on any evidence extracted. In traditional digital forensics write-blockers are used to preserve the integrity of that evidence and prevent changes from occurring, but... The integrity of any original evidence is fundamental to a forensic examination. Preserving the integrity of digital evidence is vitally important as changing just one bit among perhaps gigabits of data, will irrevocably alter that data and cast doubt on any evidence extracted. In traditional digital forensics write-blockers are used to preserve the integrity of that evidence and prevent changes from occurring, but virtual machine forensics presents more difficult challenges to address. Access to the digital storage device will probably not be possible, typically the only accessible storage will be a virtual hard disk drive. This will have the same integrity issues as those of a real device, but with the added complication that it is not possible to use a hardware write-blocker to prevent changes to those data. For this reason it is important to explore how to implement write-blocking mechanisms on a virtual device. In this paper we present an implementation of a software write-blocker and show how we can use it to be compliant with the 2nd ACPO principle on digital evidence. Read More Read Less

Abstract With the rise of cyber-attack activities in the recent years, research in this area has gained immense emphasis. One of such research efforts is modeling of cyber-attacks. In this context, several modeling approaches have been developed, such as approaches based on attack trees (AT). In this paper, we propose a novel modeling, Stochastic Game Nets (SGN) and use it to model and analyze... With the rise of cyber-attack activities in the recent years, research in this area has gained immense emphasis. One of such research efforts is modeling of cyber-attacks. In this context, several modeling approaches have been developed, such as approaches based on attack trees (AT). In this paper, we propose a novel modeling, Stochastic Game Nets (SGN) and use it to model and analyze the attack action in Border Gateway Protocol (BGP) networks. Firstly, the definition and modeling algorithm of SGN are given. And then we apply the SGN method to describe the attack and defense course in BGP networks. Finally, we analyze the attack time and attack probability in the BGP quantificationally based on the method successfully. The method can also be applied to other areas with respect to a game. Read More Read Less

Abstract Intrusion Detection System deals with huge amount of data which contains irrelevant and redundant features causing slow training and testing process, also higher resource consumption as well as poor detection rate. It is not simply removing these irrelevant or redundant features due to deteriorate the performance of classifiers. Furthermore, by choosing the effective and important features, the classification mode and the classification performance... Intrusion Detection System deals with huge amount of data which contains irrelevant and redundant features causing slow training and testing process, also higher resource consumption as well as poor detection rate. It is not simply removing these irrelevant or redundant features due to deteriorate the performance of classifiers. Furthermore, by choosing the effective and important features, the classification mode and the classification performance will be improved. Rough Set is the most widely used as a baseline technique of single classifier approach on intrusion detection system. Typically, Rough Set is an efficient instrument in dealing with huge dataset in concert with missing values and granularing the features. However, large numbers of generated features reducts and rules must be chosen cautiously to reduce the processing power in dealing with massive parameters for classification. Hence, the primary objective of this study is to probe the significant reducts and rules prior to classification process of Intrusion Detection System. All embracing analyses are presented to eradicate the insignificant attributes, reduct and rules for better classification taxonomy. Reducts with core attributes and minimal cardinality are preferred to construct new decision table, and subsequently generate high classification rates. In addition, rules with highest support, fewer length, high Rule Importance Measure (RIM) and high coverage rule are favored since they reveal high quality performance. The results are compared in terms of the classification accuracy between the original decision table and a new decision table. Read More Read Less