Potential Evidence Detection for Efficient Cloud Forensics using Quantification and Triage

Abstract

Cloud forensics is an investigation process of cybercrimes that have occurred using cloud services as a target or source or as an environment. The investigation needs digital evidence data that can prove in a court, that the event has happened. All of the data that is generated in the cloud cannot be used as evidence. However, the data which is generated during the attack can have traces of the event and hence it can be used as evidence data during a forensic investigation. The traditional approach of detecting and acquiring evidence data includes manual efforts. The different facets of cloud computing affect cloud forensics and make it a challenging process. Evidence acquisition is done at the Virtual Machine (VM) level using an agent-based collection mechanism. The collected evidence data needs to be stored with a chain of custody for the evidence to be admissible in a court of law. There is a need for guidelines and an effective approach for cloud forensics. The main goal of this research is to provide a cloud forensics system that detects and collects the evidence data in a cloud environment at a hypervisor level thereby reducing manual efforts using an AI Approach. newlineIn this research: - newline newline Hypervisor-level monitoring methods are explored to detect the evidence data generated during an attack. newline AI-based agent is proposed which is modeled for Evidence Detection in the cloud environment. newline A novel feature set is presented that monitors the rate of VM activities at the hypervisor level. The performance of the proposed system is tested with the novel feature set. newlineThis proposed method of evidence detection and acquisition is integrated with an evidence provenance system that stores the detected evidence in a blockchain. This ensures the chain of custody of the evidence data. The evidence acquisition considers the triage of the detected evidence based on the volatile nature of the data. newline newline