Forensic Profiling System

Incidents related to hacking and network intrusion are on the increase. Most organizations safeguard themselves against cyber attacks by employing security methods such as encryption technologies, network monitoring tools, deploying firewalls and intrusion detection and response mechanisms. Even though prevention mechanisms are in place the vulnerabilities associated with any computer network or security tool can be exploited by hackers to generate attacks. A major drawback in apprehending cyber criminals is lack of efficient attribution mechanisms. This paper proposes a forensic profiling system which accommodates real-time evidence collection as a network feature to address the difficulties involved in collecting evidence against cyber attackers. Forensic profiling system is based on client-server architecture and comprises of a centralized forensic server and each network component is configured as a forensic client. The forensic clients are programmed to look for discrepancies/malicious activities and subsequently, log the detected suspicious activity to the forensic server. The forensic server collects evidence related to the suspicious activities and matches them to the forensic profile database that contains descriptors for investigated attacks. The forensic server later queries the clients in order to receive more information about the alerts received by it. The agents installed in each of the forensic clients continuously monitor the activities of an individual client. In case a suspicious activity is detected, the client sends an alert to the forensic server along with the log entries that substantiate such activity. During the latent state of the network, the forensic profile of an attack contains alerts associated with it. When an alert is received by the forensic server the latent profiles that contain a match for the received alert become active. Depending upon the received alert, and referring to the profile database, the forensic server probes the clients. An active profile would contain all the alerts associated with the attack along with the corresponding log entries. The log entries stored in the forensic server provides the forensic evidence and speeds up the investigation process.