Please enable JavaScript.

Coggle requires JavaScript to display documents.

Week 8 Forensics (Collection Phase (Remote acquisition (Web app logs…

- - - - History
      - Cache
        
        Server tells client to keep some data so that it doesn't have to rerequest it again
      - Cookies
    - - Use TLS or PGP
      - Companies keep logs
  - - - Use promisc or mon mode to listen
      - Capture packets
    - - Routers configured to log all traffic that passes
      - Less storage space
    - - Use this to ID a MAC to an IP
  - - - Login attempts
      - Signups
      - Sent/received messages
      - Typically standard logging formats are employed
    - - Figures out web root based on domain requested
    - - Challenging since a large number of computers are involved (distributed)
      - Cant use physical disk imaging
      - Need rapid response, collab with CSP (Cloud Service Provider), and automation of tasks for scalability
      - Only the owner of cloud knows keys/password. CSP admin will be able to bypass
    - - Reactive (open source forensics)
      - Proactive (open source intelligence)
    - - It's already logged in when we get there
      - We find creds
      - Extract session cookie from disk image
- - - - How central a node or edge is
      - Average centrality of network
      - 3 methods of measure
        
        Degree
        
        No. edges originating or terminating at the node
        
        eg. Number of distinct email addresses communicated with by an individual
        
        Node with high degree is called hub
        
        Closeness
        
        Total distance to other nodes
        
        High closeness suggest the node is the distributor of info to the rest of the network
        
        Betweenness
        
        Shortest paths that go from A to C that must pass through B
        
        High betweeness suggests that the node is a carrier of info between two other parties.
        
        A good target for disrupting a criminal network
    - - Nodes that are referenced more are likely to be more interesting
    - - Splitting a large network into subgraphs
    - - Finding nodes that are more connected together than with other nodes
      - NP-Complete
      - Lose info because we are removing relations between nodes
  - - - Calculating how many times an event occured within windows of time
    - - Combining networks to a timeline of events to harness the power of both information
      - Insider trading: Did these two nodes recieve info from this node at this time