Quality assurance evidence collection model for MSN forensics

Abstract

Instant Messaging (IM) applications have become an important tool for business and social communication. However, when using IM, individuals and companies expose themselves to many security threats. Collecting all available data and preserving the integrity of evidence is a challenging task to perform IM forensics. In particular, under resource constrained situations, a good evidence collection mechanism is required to provide effective event collection in a network environment with heavy traffic. The emphasis of this paper is on the development of an effective evidence collection control mechanism that achieves an optimal outcome with a reasonable forensic service requests acceptance ratio and tolerable level of data capture loss. In this paper, we propose an evidence collection control model used in network forensics, called Quality Assurance Evidence Collection (QAEC). QAEC dynamically adjusts the amount of data to be collected on an evidence flow according to the storage capacity level. QAEC is firstly modeled as the Continuous Time Markov Chain (CTMC) and is realized by a cost function that comprises both flow-level and packet-level components to reflect the efforts on the evidence reconstruction process. We also present a prototype system (known as the MSN-Shot) as a MSN forensic system which uses QAEC to select an appropriate evidence collection strategy to maximize the given cost function. With the numerical analysis and prototype results, this study confirmed that the QAEC model meets cost-effective requirements and provides a practical security solution and guarantees a high level of quality assurance for network forensics.