Florian Buchholz and Eugene H. Spafford

CERIAS TR 2007-68

inbook

It is desirable to be able to gather more forensically valuable audit data from computing systems than is currently done or possible. This is useful for the reconstruction of events that took place on the system for the purpose of digital forensic investigations. In this paper, we propose a mechanism that allows arbitrary meta-information bound to principals on a system to be propagated based on causality influenced by information flow. We further discuss how to implement such a mechanism for the FreeBSD operating system and present a proof-of-concept implementation that has little overhead compared to the system without label propagation.

PDF

2007

Computers & Security

Buchholz

Elsevier

James Madison University, CERIAS

2007-01-01

1. Introduction 2. Related Work 2.1 Static Information Flow Analysis 2.2 Dynamic Analysis 3. Propagation Model 3.1 Causality and Labels 3.2 Description of the Model 3.3 Properties of the Propagation Model 4. Implementation 4.1 Subsystems Affected by Label Propagation 4.2 Data Structures and Operations 4.3 IPC: Sockets 4.4 Shared Resources: Files 5. Results 5.1 User Influence 5.2 Location Information 5.3 Remote System Compromise 5.4 Performance Overhead 6. Conclusion

Forensic Audit Data, Run-time Label Propagation

English

Run-Time Label Propagation for Forensic Audit Data