ICFF：一种IaaS模式下的云取证框架

doi:10.3969/j.issn.1000-436x.2013.05.023

通信学报 ›› 2013, Vol. 34 ›› Issue (5): 200-209.doi: 10.3969/j.issn.1000-436x.2013.05.023

• 学术通信 • 上一篇

ICFF：一种IaaS模式下的云取证框架

谢亚龙^1,²,丁丽萍¹,林渝淇¹,赵晓柯¹

¹ 中国科学院软件研究所基础软件国家工程研究中心，北京 100190;
² 中国科学院研究生院，北京 100190

出版日期:2013-05-25 发布日期:2017-06-27
基金资助:
国家科技重大专项基金资助项目;国家科技重大专项基金资助项目;中国科学院知识创新工程基金资助项目;中国科学院知识创新工程基金资助项目;国家自然科学基金资助项目

ICFF: a cloud forensics framework under the IaaS model

Ya-long XIE^1,²,Li-ping DING¹,Yu-qi LIN¹,Xiao-ke ZHAO¹

¹ National Engineering Research Center of Fundamental Software,Institute of Software,Chinese Academy of Sciences,Beijing 100190,China;
² Graduate University of Chinese Academy of Sciences,Beijing 100190,China

Online:2013-05-25 Published:2017-06-27
Supported by:
The National Science and Technology Major Project;The National Science and Technology Major Project;The Knowledge Innovation Key Directional Program of Chinese Academy of Sciences;The Knowledge Innovation Key Directional Program of Chinese Academy of Sciences;The Na-tional Natural Science Foundation of China

摘要/Abstract

摘要：

摘要：分析了云取证技术所面临的挑战，提出了一种基础设施即服务(IaaS)云模型下的取证框架ICFF，并在开源IaaS云平台Eucalyptus中进行了实现，最后通过实验的方法对ICFF进行了验证分析。实验结果表明，该框架能够有效并快速地获取云平台中的证据数据。

关键词: 云计算, 数字取证, 云取证, IaaS模式

Abstract:

Technical challenges of cloud forensics was summarized and a forensics framework under an infrastructure as a service(IaaS) cloud model called ICFF was proposed.Then,this framework on the open source IaaS cloud platform Eucalyptus was implemented.Finally,a test case to demonstrate the effectiveness of ICFF was designed.Experiments show that the framework can obtain evidence data in cloud platform effectively and efficiently.

Key words: cloud computing, digital forensics, cloud forensics, IaaS model

谢亚龙,丁丽萍,林渝淇,赵晓柯. ICFF：一种IaaS模式下的云取证框架[J]. 通信学报, 2013, 34(5): 200-209.

Ya-long XIE,Li-ping DING,Yu-qi LIN,Xiao-ke ZHAO. ICFF: a cloud forensics framework under the IaaS model[J]. Journal on Communications, 2013, 34(5): 200-209.

图/表 8

图1

图2

图3

图4

图5

图6

表1

表2

参考文献 18

[1]	SIMSON L G . Digital forensics research: the next 10 years[J]. Digital Investigation, 2010,(7):64-73.
[2]	WOLTHUSEN S D . Overcast: forensic discovery in cloud environ-ments[A]. The 5th International Conference on IT Security Incident Manage ment and IT Forensics[C]. Stuttgart, 2009. 3-9.
[3]	KEYUN R, , JOE C , TAHAR K , et al . Cloud forensics: an overview[A]. 7th IFIP Conference on Digital Forensics[C]. Florida,USA, 2011. 35-46.
[4]	BIGGS S , VIDALIS S . Cloud computing: the impact on digital foren-sic investigations[A]. International Conference for Internet Technol-ogy and Secured Transactions[C]. London,Engloud, 2009. 1-6.
[5]	BIRK D , WEGENER C . Technical issues of forensic investigations in cloud computing environments[A]. IEEE 6th International Workshop on Systematic Approaches to Digital Forensic Engineering[C]. Oak-land, 2011. 1-10.
[6]	Eucalyptus[EB/OL]. http://www.eucalyptus.com/.
[7]	NURMI D , WOLSKI R , GRZEGORCZYK C , et al . The eucalyptus open-source cloud-computing system[A]. IEEE/ACM International Sym-posium on Cluster Computing and the Grid[C]. Shanghai,China, 2009. 124-131.
[8]	KEYUN R , IBRAHIM B , JOE C , et al . Survey on cloud forensics and critical criteria for cloud forensic capability: a preliminary analysis[A]. Proceedings of the ADFSL Conference on Digital Forensics,Security and Law[C]. Virginia,USA, 2011. 105-121.
[9]	REILLY D , WREN C , BERRY T . Cloud computing: forensic challenges for law enforcement[A]. International Conference for Internet Technology and Secured Transactions[C]. London,En-gloud, 2010. 1-7.
[10]	ELIE B , IVAN F , MATTHIEU M , et al . Doing forensics in the cloud age OWADE: beyond files recovery forensic[A]. Black Hat[C]. Las-Vegas,USA, 2011. 1-23.
[11]	ZAFARULLAH Z , ANWAR F , ANWAR Z . Digital forensics for eucalyptus[A]. Frontiers of Information Technology[C]. Islamabad, 2011. 110-116.
[12]	周刚 . 云计算环境中面向取证的现场迁移技术研究[D]. 武汉：华中科技大学， 2011.
[13]	WU J Z , DING L P , WANG Y J , et al . Identification and evaluation of sharing memory covert timing channel in xen virtual machines[A]. IEEE 4th Conference on Cloud Computing[C]. Washington DC,USA, 2011. 283-291.
[14]	WU J Z , DING L P , LIN Y Q , et al . Xenpump: a new method to miti-gate timing channel in cloud computing[A]. IEEE 5th Conference on Cloud Computing[C]. Hawaii,USA, 2012. 678-685.
[15]	PAUL B , BORIS D , KEIR F , et al . Xen and the art of virtualization[A]. Proceedings of the Nineteenth ACM Symposium on Operating Sys-tems Principles[C]. New York,USA, 2003. 164-177.
[16]	XU W , HUANG L , FOX A , et al . Detecting large-scale system prob-lems by mining console logs[A]. Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Priciples[C]. New York,USA, 2009. 117-132.
[17]	HU Z B , SU J , SHIROCHIN V P . An intelligent lightweight intrusion detection system with forensics technique[A]. 4th IEEE Workshop on Intelligent Data Acquisition and Advanced Computing Systems:Technology and Applications[C]. Dortmund, 2007. 647-651.
[18]	CVE-2008-4250[EB/OL].

时间	来源	事件	描述
2012-6-13 15:51:36	VM01-Browser	8032	浏览器服务已很多次无法正常启动
2012-6-13 15:51:46	VM01-Security	680	源工作站：VvvWoTb5JV
2012-6-13 15:51:46	VM01-Security	529	源网络地址：192.168.1.110
2012-6-13 15:52:14	VM01-Security	592	已经创建新的过程

时间	来源	进程ID	进程名
2012-6-13 15:50:54	VM01	1964	mshta.exe
2012-6-13 15:50:56	VM01	1032	mmc.exe
2012-6-13 15:52:14	VM01	2348	cmd.exe
2012-6-13 15:53:10	VM01	1152	ftp.exe
2012-6-13 15:54:31	VM01	1604	sfind.exe
2012-6-13 15:56:03	VM01	3372	G_Server.exe

ICFF：一种IaaS模式下的云取证框架

ICFF: a cloud forensics framework under the IaaS model

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献 18

相关文章 15

Metrics

推荐阅读 0

[1]	马玲, 樊漆亮, 许婷, 郭冠琛, 张圣林, 孙永谦, 张玉志. 基于强化学习的在线离线混部云环境下的调度框架[J]. 通信学报, 2023, 44(6): 90-102.
[2]	王化群, 刘哲, 何德彪, 李继国. 公有云中身份基多源IoT终端数据PDP方案[J]. 通信学报, 2021, 42(7): 52-60.
[3]	张键红, 武梦龙, 王晶, 刘沛, 姜正涛, 彭长根. 云环境下安全的可验证多关键词搜索加密方案[J]. 通信学报, 2021, 42(4): 139-149.
[4]	李瑞琪, 贾春福, 王雅飞. 基于NTRU的多密钥同态代理重加密方案及其应用[J]. 通信学报, 2021, 42(3): 11-22.
[5]	张嘉伟, 马建峰, 马卓, 李腾. 云计算中基于时间和隐私保护的可撤销可追踪的数据共享方案[J]. 通信学报, 2021, 42(10): 81-94.
[6]	王文娟, 杜学绘, 单棣斌. 基于动态概率攻击图的云环境攻击场景构建方法[J]. 通信学报, 2021, 42(1): 1-17.
[7]	田有亮,骆琴. 基于改进Merkle-Tree认证方法的可验证多关键词搜索方案[J]. 通信学报, 2020, 41(9): 118-129.
[8]	王娜,郑坤,付俊松,李剑. 基于分块的移动边缘计算密文检索方法[J]. 通信学报, 2020, 41(7): 95-102.
[9]	赵临东,庄文芹,陈建新,周亮. 异构蜂窝网络中分层任务卸载：建模与优化[J]. 通信学报, 2020, 41(4): 34-44.
[10]	梁冰,纪雯. 基于次模优化的边云协同多用户计算任务迁移方法[J]. 通信学报, 2020, 41(10): 25-36.
[11]	苏命峰,王国军,李仁发. 基于利益相关视角的多维QoS云资源调度方法[J]. 通信学报, 2019, 40(6): 102-115.
[12]	陈兴蜀,滑强,王毅桐,葛龙,朱毅. 云环境下SDN网络低速率DDoS攻击的研究[J]. 通信学报, 2019, 40(6): 210-222.
[13]	王万良, 臧泽林, 陈国棋, 屠杭垚, 王宇乐, 陆琳彦. 大规模云计算服务器优化调度问题的最优二元交换算法研究[J]. 通信学报, 2019, 40(5): 180-191.
[14]	王田,沈雪微,罗皓,陈柏生,王国军,贾维嘉. 基于雾计算的可信传感云研究进展[J]. 通信学报, 2019, 40(3): 170-181.
[15]	何欣枫,田俊峰,刘凡鸣. 可信云平台技术综述[J]. 通信学报, 2019, 40(2): 154-163.