TY - GEN
T1 - IR4CF
T2 - IEEE 2nd International Conference on Computing, Control and Industrial Engineering, CCIE 2011
AU - Xu, Lei
AU - Tian, Zhihong
AU - Ye, Jianwei
AU - Zhang, Hongli
PY - 2011
Y1 - 2011
N2 - When computer intrusions occur, one of the most costly, time-consuming, and human-intensive tasks is to analysis and take the evidence of the compromised system. IR4CF: a system call based intrusion replay system for supporting the computer forensics. IR4CF uses three key mechanisms to improve the accuracy and reduce the human overhead of performing forensic analysis. First, it streams the kernel event information in real-time, to append-only storage on a separate, hardened, logging machine, making the system resilient to a wide variety of attacks. Second, it uses system-call hijacking technology to perform comprehensive monitoring of the execution of a target system at the kernel event level, giving a high-resolution, application-independent view of all activity. Third, it analyses and replays the intrusion actions dynamically, which can be used for evidence in a court of law.
AB - When computer intrusions occur, one of the most costly, time-consuming, and human-intensive tasks is to analysis and take the evidence of the compromised system. IR4CF: a system call based intrusion replay system for supporting the computer forensics. IR4CF uses three key mechanisms to improve the accuracy and reduce the human overhead of performing forensic analysis. First, it streams the kernel event information in real-time, to append-only storage on a separate, hardened, logging machine, making the system resilient to a wide variety of attacks. Second, it uses system-call hijacking technology to perform comprehensive monitoring of the execution of a target system at the kernel event level, giving a high-resolution, application-independent view of all activity. Third, it analyses and replays the intrusion actions dynamically, which can be used for evidence in a court of law.
KW - Auditing
KW - Forensics
KW - Intrusion replay
UR - https://www.scopus.com/pages/publications/80053219290
U2 - 10.1109/CCIENG.2011.6007958
DO - 10.1109/CCIENG.2011.6007958
M3 - 会议稿件
AN - SCOPUS:80053219290
SN - 9781424495979
T3 - CCIE 2011 - Proceedings: 2011 IEEE 2nd International Conference on Computing, Control and Industrial Engineering
SP - 66
EP - 69
BT - CCIE 2011 - Proceedings
Y2 - 20 August 2011 through 21 August 2011
ER -