Fuzzy Expert System for Detecting Anti-Forensic Activities

안티 포렌식 행위 탐지를 위한 퍼지 전문가 시스템

  • 김세령 (고려대학교 정보보호대학원) ;
  • 김휘강 (고려대학교 정보보호대학원)
  • Received : 2011.04.15
  • Accepted : 2011.08.04
  • Published : 2011.10.31

Abstract

Recently, the importance of digital forensic has been magnified because of the dramatic increase of cyber crimes and the increasing complexity of the investigation of target systems such as PCs, servers, and database systems. Moreover, some systems have to be investigated with live forensic techniques. However, even though live forensic techniques have been improved, they are still vulnerable to anti-forensic activities when the target systems are remotely accessible by criminals or their accomplices. To solve this problem, we first suggest a layer-based model and the anti-forensic scenarios which can actually be applicable to each layer. Our suggested model, the Anti-Forensic Activites layer-based model, has 5 layers - the physical layer, network layer, OS layer, database application layer and data layer. Each layer has possible anti-forensic scenarios with detailed commands. Second, we propose a fuzzy expert system for effectively detecting anti-forensic activities. Some anti-forensic activities are hardly distinguished from normal activities. So, we use fuzzy logic for handling ambiguous data. We make rule sets with extracted commands and their arguments from pre-defined scenarios and the fuzzy expert system learns the rule sets. With this system, we can detect anti-forensic activities in real time when performing live forensic.

최근 사이버 범죄의 증가와 그 대상 시스템의 다양화로 인하여 디지털 포렌식의 중요성이 커지고 있다. 일부 시스템들은 전원이나 네트워크를 차단하지 않고 수사하는 live forensic의 방법을 채택하고 있는데, 인터넷 사용이 일반화됨에 따라 live forensic 방법이 채택되는 횟수가 증가하고 있다. 그러나 live forensic 기술이 상당한 발전을 거듭하였음에도 불구하고 원격으로 접근하여 행해지는 Anti-forensic 행위에는 여전히 취약한 실정이다. 이와 같은 문제를 해결하기 위하여 첫 번째로 우리는 Anti-forensic 행위를 5개의 계층으로 분류하고 각 계층별로 가능한 Anti-forensic 행위의 시나리오를 생성하는 방법을 제안하였다. 두 번째로 fuzzy 전문가 시스템을 제안하여 효과적으로 Anti-forensic 행위를 탐지할 수 있도록 하였다. 몇몇 Anti-forensic 행위에 사용되는 명령어들은 일반적인 시스템 관리를 위하여 사용되는 명령어와 매우 유사하다. 따라서 우리는 fuzzy logic을 사용하여 모호한 데이터를 다룰 수 있도록 하였다. 미리 정의된 시나리오에서 명령어와 옵션 및 인자 값을 이용하여 룰을 생성하고 fuzzy 전문가 시스템에 이 룰을 학습하도록 하여 유사한 행위가 탐지되었을 때 추론을 통하여 수사관에게 얼마나 위험한 행위인지 알려준다. 이 시스템은 live forensic 수사가 진행될 때 발생할 수 있는 Anti-forensic 행위를 실시간으로 탐지할 수 있도록 하여 증거 데이터의 무결성을 유지하도록 한다.

Keywords

References

  1. Harlen Carvey, "Windows Forensic Analysis", Syngress Publishing, ISBN 1597494224, 2009
  2. Niandong Liao, Shengfeng Tian, Tinghua Wang, "Network forensic based on fuzzy logic and expert system", Computer Communications, vol.32, issue17, pp.1881-1892, 2009. https://doi.org/10.1016/j.comcom.2009.07.013
  3. Emmanuel S.Phill, R.C.Joshi, Rajdeep Niyogi, "A Generic Framework for Network Forensic", International Journal of Computer Applications, vol.1. no.11, 2010.
  4. Christian S.J. Peron, Michael Legary, "Digital Anti-Forensic: Emerging trends in data transformation techniques"
  5. Frank Adelstein, "Live Forensic, Diagnosing your system without killing it first, Communications of the ACM, vol.49, no.2, 2006.
  6. Stuart McClure, Joel Scambray, George Kurtz, "Hacking Exposed : Network Security Secrets and Solutions", Third Edition, McGraw-Hill, ISBN 007149426X, 2007
  7. L.A. Zadeh, "The role of fuzzy logic in the management of uncertainty in expert system" Fuzzy Sets and Systems, vol.11, issue1-3, pp.197-198, 1983. https://doi.org/10.1016/S0165-0114(83)80081-5
  8. E.H. Mamdani, S. Assilian, "An Experiment in Linguistic Synthesis with a Fuzzy Logic Controller", International Journal of Man- Machine Studies, vol.7, issue1, pp.1-13, 1975 https://doi.org/10.1016/S0020-7373(75)80002-2
  9. E.H. Mamdani, "Advances in The Linguistic Synthesis of Fuzzy Controllers", International Journal of Man-Machine Studies, vol.8, issue6, pp.669-678, 1976 https://doi.org/10.1016/S0020-7373(76)80028-4
  10. Srinivas Mukkamala, Andrew H. Sung, "Identifying Significant Features for Network Forensic Analysis Using Artificial Intelligent Technologies" International Journal of Digital Evidence, vol.1, issue4, 2003.
  11. Zaiqiang Liu, Dengguo Feng, "Incremental Fuzzy Decision Tree-Based Network Forensic System", Computational Intelligence and Security, vol.3802, pp.995-1002, 2005.
  12. http://computer-forensics2.sans.org/blog/2008/11 /19/
  13. Nicolas Ruff, "Windows Memory Forensics", Journal in Computer Virology, vol.4, no.2, pp.83-100, 2007.
  14. Bryan Sartin, "Anti-Forensics - Distorting the Evidence", Computer Fraud & Security, vol.2006, issue5, pp.4-6, 2006. https://doi.org/10.1016/S1361-3723(06)70354-2
  15. Paul A. Henry, "Anti-Forensics", Secure computing
  16. Ryan Harris, "Arriving at an anti-forensic consensus: Examining how to define and control the anti-forensics problem", Digital Investigation, vol.3, supplement1, pp.44-49, 2006.
  17. Jung-Sun Kim, Dong-Geun Kim, Bong-Nam Noh, "A Fuzzy Logic Based Expert System as a Network Forensic", 2004 IEEE International Conference on, vol.2, pp.879-884, 2004.
  18. M.Saniee Abadeh, J.Habibi, C.Lucas, "Intrusion Detection using a Fuzzy genetics-based Learning Algorithm", Journal of Network and Computer Applications, vol.30, issue1, pp.414-428, 2007. https://doi.org/10.1016/j.jnca.2005.05.002
  19. Adel Nadjaran Toosi, Mohsen Kahani, "A New Approach to Intrusion Detection Based on an Evolutionary Soft Computing Model Using Neuro-Fuzzy Classifiers", Computer Communications, vol.30, issue10, pp.2201- 2212, 2007. https://doi.org/10.1016/j.comcom.2007.05.002
  20. Zaiqiang Liu, Dengguo Feng, "Incremental Fuzzy Decision Tree-Based Network Forensic System", Computational Intelligence and Security, vol.3802, pp.995-1002, 2005.
  21. http://datatracker.ietf.org/doc/rfc3227/
  22. Simon Garfinkel, "Anti-Forensics : Techniques, Detection and Countermeasures", 2nd InternationalConferenceoni-WarfareandSecurity, pp.77-84
  23. Liu, Brown, "Bleeding-Edge Anti-Forensics", Infosec World Conference and Expo, MIS Training Institute
  24. http://support.microsoft.com/kb/223316
  25. http://securotyfocus.com/archive/1/348638/2003 -12-29/2004-01-04/0
  26. http://www.shadowserver.org/wiki/pmwiki.php/ Stats/PackerStatistics
  27. Brian Hay, Kara Nance, Matt Bishop, "Live forensic Progress and Challenges", IEEE Security and Privacy, vol.7, issue2, pp.30-37, 2009.
  28. L.A. Zadeh, "Fuzzy Sets", Information and Control, pp.338-353, 1965.
  29. http://en.wikipedia.org/wiki/Triangular_distribut ion