Holmes: A data theft forensic framework

Ramya Jayaram Masti,Vincent Lenders,Mario Strasser,Stefan Engel,Bernhard Plattner

Information Forensics and Security（2011）

引用 1|浏览2

暂无评分

摘要

This paper presents Holmes, a forensic framework for postmortem investigation of data theft incidents in enterprise networks. Holmes pro-actively collects potential evidence from hosts and the network for correlation analysis at a central location. In order to optimize the storage requirements for the collected data, Holmes relies on compact network and host data structures. We evaluate the theoretical storage requirements of Holmes in average networks and quantify the improvements compared to raw data collection alternatives. Finally, we present the application of Holmes to two realistic data theft investigation scenarios and discuss how combining network and host data can improve the efficiency and reliability of these investigations.

查看译文

关键词

realistic data theft investigation,raw data collection alternative,data theft incident,host data structure,average network,postmortem investigation,enterprise network,host data,compact network,holmes pro-actively,data theft forensic framework,computer forensics,data structure,data collection,computer network security

AI 理解论文

溯源树

样例

生成溯源树，研究论文发展脉络

Chat Paper

正在生成论文摘要