Abstract
Following up on the previous work, we elaborate on the details of the design and implementation of the live and dead digital evidence gathering and its encoding into Forensic Lucid by the corresponding MAC Spoofer Analyzer’s (MSA’s) components in an actual operational environment. We monitor over a 1000 analyst-managed computers on the Faculty’s network to help network system administrators in daily network security monitoring. The common Forensic Lucid evidence encoding format represents a consistent evidence representation and allows specification of reasoning functions over the evidence in a context-oriented manner.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Alexander, I.: Misuse Cases: Use Cases with hostile intent, November 2002. http://www-dse.doc.ic.ac.uk/Events/BCS-RESG/Aleksander.pdf
Assels, M.J., Echtner, D., Spanner, M., Mokhov, S.A., Carrière, F., Taveroff, M.: Multifaceted faculty network design and management: practice and experience. In: Desai, B.C., Abran, A., Mudur, S. (eds.) Proceedings of C\(^{3}\)S\(^{2}\)E 2011, pp. 151–155. ACM, New York, May 2010–2011. short paper; full version online at http://www.arxiv.org/abs/1103.5433
Bejtlich, R.: The Tao of Network Security: Beyond Intrusion Detection. Addison-Wesley, New York (2005). ISBN: 0-321-24677-2
van den Berg, S.R., Guenther, P.A.: procmail v3.22, September 2001. http://www.procmail.org/
Carrier, B.D.: Risks of live digital forensic analysis. Commun. ACM 49(2), 57–61 (2006). http://www.d.umn.edu/~schw0748/DigitalForensics/p56-carrier.pdf
Cisco Systems Inc: Catalyst 2950 Switch Hardware Installation Guide, October 2003
Clark, K., Hamilton, K.: Cisco LAN Switching. Cisco Press (1999). ISBN: 1-57870-094-9
Day, J.D.: The (un)revised OSI reference model. SIGCOMM Comput. Commun. Rev. 25(5), 39–55 (1995)
McDougal, M.: Live forensics on a Windows system: using Windows Forensic Toolchest (WFT) (2003–2006). http://www.foolmoon.net/downloads/Live_Forensics_Using_WFT.pdf
Mokhov, S.A.: Intensional Cyberforensics. Ph.D. thesis, Department of Computer Science and Software Engineering, Concordia University, Montreal, Canada, September 2013. http://arxiv.org/abs/1312.0466
Mokhov, S.A., Assels, M.J., Paquet, J., Debbabi, M.: Toward automated MAC spoofer investigations. In: Proceedings of C3S2E 2014, pp. 179–184. ACM, August 2014 (short paper)
Odom, W.: CCENT/CCNA ICND1: 640–822 Official Cert Guide, 3rd edn. Cisco Press (2012). ISBN: 978-1-58720-425-8
Odom, W.: CCNA ICND2: 640–816 Official Cert Guide, 3rd edn. Cisco Press (2012). ISBN: 978-1-58720-435-7
Pearce, C.: Computing forensics: a live analysis, April 2005. http://www.linux.org.au/conf/2005/security_miniconf/presentations/crpearce-lca2005.pdf
Plummer, D.C.: RFC 826: An Ethernet Address Resolution Protocol, November 1982. http://tools.ietf.org/html/rfc826, viewed in December 2012
QoSient, LLC.: Argus: Auditing network activity (2000–2013). http://www.qosient.com/argus/
RJK: Regexp syntax summary, June 2002. http://www.greenend.org.uk/rjk/2002/06/regexp.html, last viewed May 2008
Tanenbaum, A.S., Wetherall, D.J.: Computer Networks, 5th edn. Prentice Hall (2011). ISBN: 978-0-13-212695-3
Vincent, J., Rolsky, D., Chamberlain, D., Foley, R., Spier, R.: RT Essentials. O’Reilly Media, Inc., August 2005
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2015 Springer International Publishing Switzerland
About this paper
Cite this paper
Mokhov, S.A., Assels, M.J., Paquet, J., Debbabi, M. (2015). Automating MAC Spoofer Evidence Gathering and Encoding for Investigations. In: Cuppens, F., Garcia-Alfaro, J., Zincir Heywood, N., Fong, P. (eds) Foundations and Practice of Security. FPS 2014. Lecture Notes in Computer Science(), vol 8930. Springer, Cham. https://doi.org/10.1007/978-3-319-17040-4_11
Download citation
DOI: https://doi.org/10.1007/978-3-319-17040-4_11
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-17039-8
Online ISBN: 978-3-319-17040-4
eBook Packages: Computer ScienceComputer Science (R0)