Exploratory Study on Computer Forensics Technology

Exploratory Study on Computer Forensics TechnologyDan HuInformation School of Yunnan University of Finance and EconomicsKunming 650221,Chinae-mail: xxhd_cn@Abstract—The study of computer forensics technology signifymuch to attacking computer crime, invasion hunting, patchsafety-bug, perfect safety system of network. This text makes athorough and compact study on advancing computer forensicstechnology both at home and abroad; make an introduction ofadvancing technology, such as, dynamic computer forensicsbased on data mining, dynamic computer forensics based onMulti-agent, detecting and forensics system based on Web，which has great significance to development of computerforensics technology in our country.Keywords-data mining; dynamic forensics; computerforensicsI.I NTRODUCTIONComputer got involved in criminal activities more and more，being the attacking target or criminal tool，the information safety problem become outstanding day by day ，situation is getting more and more complicated. Attacking computer criminal is of great urgency，which is taken as an entirely new branch-computer forensics are getting more and more study and attention. Computer forensics can hunt invasion besides attacking computer criminal; makecomplementation on firewall and invasion detecting system;good complementation on system info of the whole networksafety. This text summarize the advancing technology ofcomputer forensics，which is very important to thedevelopment of computer forensics in our country.II.D YNAMIC COMPUTER FORENSIC BASED ON DATAMININGThe computer forensics process mainly includesobtaining evidence, identifying evidence and analyzingevidence. According to different computers of generating log，the time interval that blog data is covered and rewritten isseveral minutes at least or a couple of months at most，inthe evidence obtaining stage，person who obtain evidencemust take action as soon as possible，otherwise these blogmay disappear forever; with the development of computerhacker ，the suspect will clear or revise the evidence to hidethe trace . So the static forensics obtained after the computer， which bring difficulty to evidence analysis，soModel of computer dynamic forensics is as figure1:Figure 1. Model of computer dynamic forensicsData analysis is the key point of dynamic computerforensics. Because of computer criminal characteristics, formand difference of electronic evidence from common evidence，there are some problems of dynamic forensics: collectionor examination will change the original state of evidence;computer一digital investigation and evidence is new forlaw execution, court and legislature; explosive increasingdigital media density, pervasive computer platform; non-visualized digitalized data or hiding data，transient，the data size is ever expanding，so there is tooclassification, connection analysis of main technology ofdata mining is helpful to solve the real-time, validity andintelligentized problem of dynamic forensics. The dynamicforensics model based on data mining consist of dataacquiring, data mining, data analysis, evidence identification,perpetuation of evidence, subsystem of evidence submission.In the whole process of forensics，the data warehouse，knowledge base and evidence can renovate constantly，invasion detecting and dynamic forensics are interactive.After the data collection module collect large number ofdata via computer forensics，the key of dynamic forensics ishow to get effective information from mass data，examineand judge the electric evidence which is relevant to case,reflect objective fact and can be accepted by court. So, dataanalysis module is the key point of dynamic forensics. In thedata analysis stage of dynamic forensics，the data need to befiltered ，according to the process that data confirm thecriminal，include invasion time, using IP address, therevised document, added document, deleted document,uploaded and downloaded document. Obtaining real-time 2009 Second International Conference on Computer and Electrical Engineeringdata in advance is the fundamental difference of dynamic forensics from static forensics ，even the revision of original dynamic forensics ，problems.III. D YNAMIC C OMPUTER FORENSICS BASED ON M ULTI-AGENTreflex action ，it solve the problem after it is attacked ，then wait the next attack absently. To improve the ability of network safety protection, besides the passive safety tools, such as firewall, X-scan ，the active network safety protection also need to be taken, such as ，network trap, invasion forensics, invasion detecting, automatic recover, etc. The network safety should be three-dimensional security system include physical isolation, firewall, invasion detecting system, risk inspection, virus protection, So a dynamic computer forensics based on Multi-agent is information, the invasion process reappear. So the shortage of real-time, discontinuity, insufficiency of static forensics can be overcome.This paper presents a model of dynamic computer forensics based on multi-agent. This model can collect invasion evidences real-timely, accurately and entirely, and integrate and order these evidences. Therefore the limitation of static computer forensics is overcome, such as non-real-time, non-continuity and non-sufficiency.The biology immune system has the ability of dealing distributed task without control of any center. The immune cell has the common characteristics of agent in essence ，so a distributed and coordinated autonomy system is formed. So ，in dynamic forensics model based on Multi-agent ，surveillance agent(SA),cooperation agent(CA), beating back other immunity agent ，or communication between different agents ，，that is ，monitoring network activities ，and execute detecting, trace invasion according security strategy; BA can perform self-defense on invasion and beating back; FA conduct forensics on network invasion ，provide law evidence afterinvasion response ，restore system ，the corresponding logic structure of agent is as following figure 2:Figure 2. Logic Structure of ModelMultiple immunity Agent exist in network ，locate in each network node separately ，complete network security task together ，and cooperate with SA and BA closely ，once SA have detected invasion, it inform its corresponding response system ，FA begin to work under the stimulation of beating back system(BA). SA inform the detected information (invasion kind ，invasion time and invaded host address) to FA ， and complete corresponding forensics in corresponding client computer, which is As following figure Forensics Agent (FA)evidence serverFigure 3. system modelFA acquires invasion attack characteristics, category, invaded host address from SA, BA and forensics from corresponding host. The data collecting model collect the original invasion data, include host information and network information, and make a backup of the original evidence, make a digital signature and time stamp on the algorithm permitted by nation. The encrypt standard conform to PKJ standard. Ensure the authority and indefensibility of original evidence to add its legal validity. Deliver the signed originalevidence to evidence server via VPN. The evidence server add digital signature and time stamp after it receive the evidence to complete the transfer process from local to evidence server. Digital analyze and sort out the backup of original evidence, the sorted result can be displayed in readable method. The result must be with certainty, without any assumption and personal advice, with validity of legal argument and enough persuasion. Make a digital signature and timestamp on the algorithm permitted by nation. The analysis encrypted result is delivered to evidence server via VPN, the evidence server add digital signature and time stamp after it receive the evidence, complete the transfer process from local to evidence server.Figure 4. realizing modelThe original evidence include two categories: main frame information and network information，main frame data information include user connection, process status, file system, swap subzone, EMS memory/external medium，system blog; The connection information is tracing current session, user’s log-in and log-out information. The progress status information is record of activities. Its network information include each network data packet at invasion moment，and using protocol, port, source address, target address, quantity of network connection, status ,quantity of average delivering packet, connection time. Data analysis includes data reduction analysis and data statistic analysis.The dynamic forensics based on Multi-agent can collect invasion evidence rapidly, accurately and entirely when invasion happen. Adopting Multi-agent in security protection system of dynamic network three-dimensional is more persuasive and has more forceful validity. It is a new try in dynamic forensics.IV.T HE FORENSICS SYSTEM OF NETWORK INVASIONDETECTING BASED ON W EBIn network forensics，the key is the detecting, record and analysis of invasion, include abnormal detecting and misusing detecting. The former adopt statistical analysis method，the later mainly adopt detecting method based on rule. According to different objects ，there are two detecting : One is based on main frame; the other is based on network. Mainframe detecting mainly analyze network data of single mainframe to search possible invasion ;network detecting is similar to firewall，and it is usually set up on the single unit to analyze the flow data of network. Using one method can’tensure the security of the whole system，especially the invasion of network and internal of system. So there is，it analyze to event analyzer，agent，to find the possible invasion event and make corresponding process. This technology can ensure the security of mainframe and also can ensure the networksecurity，which can prevent the internal invasion effectively.For the real-time detection based on network invasion，the algorithm must be fast enough，at least it can match common network speed . From the point of practical angle,the algorithm must be expanded easily，so the detecting method can be updated easily and rapidly when new attack method appear. so in Linux operating system, Snort act asinner core，MySQLact as database of background，a network invasion detecting and forensics system with high efficient and based on Web is developed with Perl. The structure of system is as following figure 5:Figure 5. the structure of network invasion detecting system based onWebThe design of the whole system focus on improving the working efficient of invasion detecting data ，take full advantage of the information source to realize automation of data collection, record, analysis and event-response，easing labor of network management staff. This system can detect various invasion accurately in time，the detailed and accurate recorded data meet the requirement of forensics，provide abundant analysis and inquiry request . Of course，with the expanding of network size and march of time，database will be larger and larger，so the data analysis will be more and more difficult. Further study and forensics is needed.V.D ISTRIBUTED DYNAMIC COMPUTER FORENSICSThe distributed dynamic computer forensics, conduct real-time and dynamic collection of evidence in protected system, and store the evidence in evidence center in time and completely, provide reliable original evidence data foranalyzing and fetching of evidence. The system model is asfollowing figure 7:Figure 6. Distributed dynamic computer forensicsThe whole system adopt C/S structure，include severalparts as follows:1)The evidence collector based on distributed multipleAgent mechanism，conduct distributed collection ofevidence;2)The concentrated storage center of evidence，conduct safe concentrated storing of evidence;3))Special communication protocol，ensure thesecurity and integrity of evidence transmission;4)Evidence analysis center，provide user effective andfinal evidence after analyzing.5)User interface and management window of userconfiguration ，manage the system of user. This system hasmerits of two aspects.6)Dynamic real-time forensics ability of network7)Expandability of forensics; flexible evidence processand analysis method.VI.C ONCLUSIONSAt present，the public security organ of each provincehas established special police to attack computer crime ，butthese law enforcement agency lack effective tools，theyonly have some common forensics tolls or experience ofthemselves. There is no integrated and standard flow ofcomputer forensics. So the evidence provided by them iscalled into question, the society source need to be organizedeffectively，embark on technology research of guardingagainst and attack computer crime. This text present adetailed investigation of advancing computer forensics bothhome and abroad, which is great significant to developmentof computer forensics of our country.R EFERENCES[1]M. Noblet，M.Pollit and L.Presley, Recording and ExaminingComputer Forensic Evidence, Forensic Science Communications,Vol2，N. 4, Oct2000[R][2]Guidance Software[J/OL], http://www. enease. com/[3]Computer Forensics[M/OL], pute:/[4]Vogon, International Limited[C/OL], http://www.vogon-data-/[5]SafeBack[C/OL]:http://www.forensics-intl. com/safeback. html[6]Md5sum:Computer forensics software, an introduction [J/OL]:http://tb. blog. csdn. net/TrackBack. aspx?PostId=388139[7]DiskScrub&GetSwap[C/OL]:http://www.forensics-Intel. com[8]The Coroners Toolkit[J/OL]:http://fish. com/tct/[9]Encase[C/OL]: /encase/frame-encase. html[10]ThumbsPlus[J/OL]:http://www. cerious. com。