Article citationsMore>>

S. Y. Willassen, “Timestamp evidence correlation by model based clock hypothesis testing,” Proceedings of the 1st International Conference on Forensic Applications and Techniques in Telecommunications, Information, and Multimedia, 2008.

has been cited by the following article:

• TITLE: Forensic Investigation in Communication Networks Using Incomplete Digital Evidences

  AUTHORS: Slim REKHIS, Jihene KRICHENE, Noureddine BOUDRIGA

  KEYWORDS: Formal Digital Investigation, Incident Response Probabilistic Cognitive Map, DigForNet, Anti- Forensic Attacks Investigation, Attack Scenarios Reconstruction

  JOURNAL NAME: International Journal of Communications, Network and System Sciences, Vol.2 No.9, December 21, 2009

  ABSTRACT: Security incidents targeting information systems have become more complex and sophisticated, and intruders might evade responsibility due to the lack of evidence to convict them. In this paper, we develop a system for Digital Forensic in Networking, called DigForNet, which is useful to analyze security incidents and explain the steps taken by the attackers. DigForNet combines intrusion response team knowledge with formal tools to identify the attack scenarios that have occurred and show how the system behaves for every step in the scenario. The attack scenarios construction is automated and the hypothetical concept is introduced within DigForNet to alleviate missing data related to evidences or investigator knowledge. DigForNet system supports the investigation of attack scenarios that integrate anti-investigation attacks. To exemplify the proposal, a case study is proposed.