Investigating Proactive Digital Forensics Leveraging Adversary Emulation
Source abstract
Abstract
Traditional digital forensics techniques are becoming obsolete due to rapid technological change. Proactive digital forensic investigations (PDFI) solve the challenges of cloud computing forensics such as evidence identification, collection, preservation, and timelining from heterogeneous cumulative data. Cumulative data heterogeneity poses significant challenges to the sound collection of electronically stored information (ESI) or digital evidence across cloud endpoints and/or networked systems. In addition, the distribution of networked systems and/or cloud environments makes it impossible for forensics investigators to be present at several premises to perform the investigation. Hence, it is important to have PDFI in place to ensure continuous operation in the event of a cyberattack, because it does not require the presence of an investigator at the target location. In this study, researchers put the idea of proactive digital forensics to the test and concluded that it is an indispensable tool for networked systems and cloud computing environments in response to modern-day digital forensics challenges. This research was based on an experimental computer science and engineering approach using a virtualised environment simulating an information communication infrastructure. To generate evidence (digital artefacts), and validate the proof-of-concept, adversary emulation was used by adapting the MITRE ATT&CK framework. Research results have shown that PDFI improves digital forensics activities in terms of speed and accuracy, thereby providing credible and timely comprehensive digital evidence. Enhanced Incident detection capabilities enable an analyst to focus much more on forensic investigation functions and thus perform their tasks effectively. However, the legality of live and/or remote forensics is still of great concern in several jurisdictions, thereby affecting the credibility of digital artefacts obtained in this manner. Nevertheless, where possible, the law component should also be kept up to date with modern-day technologies to solve any inconveniences caused by the ever-growing technology demands.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Digital and Cyber Forensics · Advanced Malware Detection Techniques · Digital Media Forensic Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Forensic Accounting & Auditing, School of Business & Management Sciences, Harare Institute of Technology, Belvedere, Harare P.O. Box BE 277, Zimbabwe
Department of Electronics and Computers, Faculty of Electrical Engineering and Computer Sciences, “Transilvania” University of Brasov, 1 Politehnicii Street, 500024 Brasov, Romania
References (35)
Show source-provided references
1. Johansen, G. (2017). Digital Forensics and Incident Response, Packt Publishing. [1st ed.].
2. Grobler, C., Louwrens, C., and von Solms, S.H. (2010, January 15–18). A multi-component view of digital forensics. Proceedings of the 2010 International Conference on Availability, Reliability and Security, Krakow, Poland.10.1109/ARES.2010.61 ↗
3. Pennington, A., Applebaum, A., Nickels, K., Schulz, T., Strom, B., and Wunder, J. (2019). Getting Started with ATT and CK, MITRE CORP.
4. Tapper, C. (2010). Cross & Tapper on Evidence, Oxford University Press.
5. Kent, K., Chevalier, S., and Grance, T. (2022, August 19). Guide to Integrating Forensic Techniques into Incident. Available online: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf.
6. Bradford, P.G., Brown, M., Perdue, J., and Self, B. (2004, January 5–7). Towards proactive computer-system forensics. Proceedings of the International Conference on Information Technology: Coding and Computing, Proceedings. ITCC 2004, Las Vegas, Nevada.10.1109/ITCC.2004.1286727 ↗
7. Alharbi, S., Weber-Jahnke, J., and Traore, I. (2011, January 15–17). The proactive and reactive digital forensics investigation process: A systematic literature review. Proceedings of the International Conference on Information Security and Assurance, Brno, Czech Republic.10.1007/978-3-642-23141-4_9 ↗
8. Network Intrusion Forensic Analysis Using Intrusion Detection System
9. Solms, S.V., Louwrens, C., Reekie, C., and Grobler, T. (February, January 29). A control framework for digital forensics. Proceedings of the IFIP International Conference on Digital Forensics, Orlando, FL, USA.
10. Exploring static and live digital forensics: Methods, practices and tools
11. Balon, N., Stovall, R., and Scaria, T. (2002, January 15–17). Computer Intrusion Forensics Research Paper. Proceedings of the CIS, Halifax, NS, Canada.
12. Digital forensic readiness: Expert perspectives on a theoretical framework10.1016/j.cose.2015.04.003 ↗
13. Arfeen, A., Ahmed, S., Khan, M.A., and Jafri, S.F.A. (2021, January 23–25). Endpoint Detection & Response: A Malware Identification Solution. Proceedings of the 2021 International Conference on Cyber Warfare and Security (ICCWS), Islamabad, Pakistan.10.1109/ICCWS53234.2021.9703010 ↗
14. Reichert, Z., Richards, K., and Yoshigoe, K. (2014, January 28–30). Automated forensic data acquisition in the cloud. Proceedings of the 2014 IEEE 11th International Conference on Mobile Ad Hoc and Sensor Systems, Philadelphia, PA, USA.10.1109/MASS.2014.135 ↗
15. Carbone, F. (2014). Computer Forensics with FTK, Packt Publishing.
16. Bunting, S., and Wei, W. (2006). EnCase Computer Forensics: The Official EnCE: EnCase? Certified Examiner Study Guide, John Wiley & Sons.
17. Secure automated forensic investigation for sustainable critical infrastructures compliant with green computing requirements10.1109/TSUSC.2017.2782737 ↗
18. Confluence of digital evidence and the law: On the forensic soundness of live-remote digital evidence collection
19. Trenwith, P.M., and Venter, H.S. (2013, January 14–16). Digital forensic readiness in the cloud. Proceedings of the 2013 Information Security for South Africa, Johannesburg, South Africa.10.1109/ISSA.2013.6641055 ↗
20. Alenezi, A., Zulkipli, N.H.N., Atlam, H.F., Walters, R.J., and Wills, G.B. (2017, January 24). The impact of cloud forensic readiness on security. Proceedings of the CLOSER, Porto, Portugal.10.5220/0006332705390545 ↗
21. Birk, D., and Wegener, C. (2011, January 26). Technical issues of forensic investigations in cloud computing environments. Proceedings of the 2011 Sixth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering, Oakland, CA, USA.10.1109/SADFE.2011.17 ↗
22. Jusas, V., Birvinskas, D., and Gahramanov, E. (2017). Methods and tools of digital triage in forensic context: Survey and future directions. Symmetry, 9.10.3390/sym9040049 ↗
23. Makura, S.M., Venter, H., Ikuesan, R.A., Kebande, V.R., and Karie, N.M. (2020, January 2–5). Proactive forensics: Keystroke logging from the cloud as potential digital evidence for forensic readiness purposes. Proceedings of the 2020 IEEE International Conference on Informatics, IoT, and Enabling Technologies (ICIoT), Doha, Qatar.10.1109/ICIoT48696.2020.9089494 ↗
24. Dodig-Crnkovic, G. (, January April). Scientific methods in computer science. Proceedings of the Promotion of Research in IT at New Universities and at University Colleges in Sweden, Skövde, Suecia.
25. Ageyev, D., Bondarenko, O., Radivilova, T., and Alfroukh, W. (2018, January 24–27). Classification of existing virtualization methods used in telecommunication networks. Proceedings of the 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT), Ukraine, Kyiv.10.1109/DESSERT.2018.8409104 ↗
26. Allen, L., Heriyanto, T., and Ali, S. (2014). Kali Linux–Assuring Security by Penetration Testing, Packt Publishing Ltd.10.1016/S1353-4858(14)70077-7 ↗
27. Chaitra, S., and Sharma, R. (2017, January 5–7). Integration of software router with Wi-Fi for enhanced security. Proceedings of the 2017 IEEE 7th International Advance Computing Conference (IACC), Hyderabad, India.10.1109/IACC.2017.0022 ↗
28. Patil, L., Fernandes, A., Kahate, A., and Salunkhe, D. (2022, August 19). Virtual Private Network Implementation on PC as a Router for Privacy of Data Transfer. Available online: https://www.irjet.net/archives/V7/i3/IRJET-V7I3292.pdf.
29. Integrated digital forensic process model10.1016/j.cose.2013.05.001 ↗
30. Strom, B.E., Applebaum, A., Miller, D.P., Nickels, K.C., Pennington, A.G., and Thomas, C.B. (2018). Mitre ATT&CK: Design and Philosophy, The MITRE Corporation. Tech. Rep.
31. Cohen, M. (2022, August 19). Velociraptor: Digging Deeper an Introduction. Available online: https://velociraptor.velocidex.com/velociraptor-e48a47e0317d?source=user_profile.
32. Cohen, M. (2022, August 19). Velociraptor’s ACL Model. Available online: https://velociraptor.velocidex.com/velociraptors-acl-model-7f497575daee.
33. A study on social engineering attacks: Phishing attack
34. A multivocal literature review on growing social engineering based cyber-attacks/threats during the COVID-19 pandemic: Challenges and prospective solutions10.1109/ACCESS.2020.3048839 ↗
35. Quintero-Bonilla, S., and Martín del Rey, A. (2020). A new proposal on the advanced persistent threat: A survey. Appl. Sci., 10.10.3390/app10113874 ↗