Abstract
We apply the theoretical framework and formal model of the observation tuple with the credibility weight for forensic analysis of the IDS data and the corresponding event reconstruction. Forensic Lucid - a forensic case modeling and specification language is used for the task. In the ongoing theoretical and practicalwork, Forensic Lucid is augmented with the Dempster-Shafer theory of mathematical evidence to include the credibility factors of the evidential IDS observations. Forensic Lucid’s toolset is practically being implemented within the General Intensional Programming System (GIPSY) and the probabilisticmodel-checking tool PRISM as a backend to compile the Forensic Lucid model into the PRISM’s code and model-check it. This work may also help with further generalization of the testing methodology of IDSs [10].
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Arasteh, A.R., Debbabi, M., Sakha, A., Saleh, M.: Analyzing multiple logs for forensic evidence. Digital Investigation Journal 4(1), 82–91 (2007)
Ashcroft, E.A., Faustini, A., Jagannathan, R., Wadge, W.W.: Multidimensional, Declarative Programming. Oxford University Press, London (1995)
Gladyshev, P., Patel, A.: Finite state machine approach to digital event reconstruction. Digital Investigation Journal 2(1) (2004)
Haenni, R., Kohlas, J., Lehmann, N.: Probabilistic argumentation systems. Tech. rep., Institute of Informatics, University of Fribourg, Fribourg, Switzerland (October 1999)
Mokhov, S.A.: Encoding forensic multimedia evidence from MARF applications as Forensic Lucid expressions. In: CISSE 2008, pp. 413–416. Springer, Heidelberg (December 2008)
Mokhov, S.A.: Towards syntax and semantics of hierarchical contexts in multimedia processing applications using MARFL. In: COMPSAC, pp. 1288–1294. IEEE CS, Los Alamitos (2008)
Mokhov, S.A., Paquet, J., Debbabi, M.: Formally specifying operational semantics and language constructs of Forensic Lucid. In: IMF 2008, pp. 197–216. GI (September 2008)
Mokhov, S.A., Paquet, J., Debbabi, M.: Reasoning about a simulated printer case investigation with Forensic Lucid. In: HSC 2009. SCS (October 2009) (to appear)
Mokhov, S.A., Vassev, E.: Self-forensics through case studies of small to medium software systems. In: IMF 2009, pp. 128–141. IEEE CS, Los Alamitos (2009)
Otrok, H., Paquet, J., Debbabi, M., Bhattacharya, P.: Testing intrusion detection systems in MANET: A comprehensive study. In: CNSR 2007, pp. 364–371. IEEE CS, Los Alamitos (2007)
Paquet, J., Mokhov, S.A., Tong, X.: Design and implementation of context calculus in the GIPSY environment. In: COMPSAC 2008, pp. 1278–1283. IEEE CS, Los Alamitos (2008)
Shafer, G.: The Mathematical Theory of Evidence. Princeton University Press, Princeton (1976)
Wan, K.: Lucx: Lucid Enriched with Context. Ph.D. thesis, Department of Computer Science and Software Engineering, Concordia University, Montreal, Canada (2006)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Mokhov, S.A., Paquet, J., Debbabi, M. (2010). Towards Automatic Deduction and Event Reconstruction Using Forensic Lucid and Probabilities to Encode the IDS Evidence. In: Jha, S., Sommer, R., Kreibich, C. (eds) Recent Advances in Intrusion Detection. RAID 2010. Lecture Notes in Computer Science, vol 6307. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-15512-3_36
Download citation
DOI: https://doi.org/10.1007/978-3-642-15512-3_36
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-15511-6
Online ISBN: 978-3-642-15512-3
eBook Packages: Computer ScienceComputer Science (R0)