AttackGraphsforProactiveDigitalForensics：积极的数字取证攻击图.docxVIP

Attack Graphs for Proactive Digital ForensicsTara McQueenDelaware State UniversityResearch Alliance in Math and ScienceOak Ridge National LaboratoryMentor: Louis P. WilderAbstract: - In order to address the need for proactive digital forensics, this project investigates a theoretical attack graph approach for real-time detection of fraudulent electronic activity. This attack graph describes the path of vulnerabilities for a Windows system in relation to Universal Serial Bus operated exploits by providing an intrusion itinerary. Every vertex event becomes a trigger in the attack graph for activation of a future plug-in feature to a software package called Splunk. This will provide systematic responses and alerts in addition to the constant monitoring and recording of Personal Computer logs. The link between this attack graph and Splunk provides a strong detection and alert system for future judicial evidence. This research has set a path for future efforts and discoveries in the field of cyber security with specific relation to proactive digital forensics.Key-words: cyber security, proactive digital forensics, exploit, attack graph, universal serial bus (USB), Splunk IntroductionDigital forensics currently works in a retroactive manor. When computer hackers go to work, cyber security teams cross their fingers hoping that a hack is detected and evidence is collected. In some cases, the hack is just like searching for a needle in a haystack. So, the next step in cyber security is to approach digital forensics in a proactive manor by detecting attacks while they are processing and providing defensive measures using containment and capture strategies.The purpose of this project is to increase cyber security as a whole by investigating a way to identify possible cyber attacks as they occur and collect evidence for judicial trials pertaining to hackers.Cyber SecurityCyber security is the art of maintaining confidentiality, availability, and access of information and data.