[论文解读] Evaluation of Digital Forensic Process Models with Respect to Digital Forensics as a Service

Xiaoyu Du, Nhien‐An Le‐Khac+1 more|arXiv (Cornell University)|Aug 5, 2017

Digital and Cyber Forensics参考文献 17被引用 54

一句话总结

这篇论文评估现有数字取证过程模型以评估它们在基于云的数字取证即服务（DFaaS）范式和云证据处理中的适用性。

ABSTRACT

Digital forensic science is very much still in its infancy, but is becoming increasingly invaluable to investigators. A popular area for research is seeking a standard methodology to make the digital forensic process accurate, robust, and efficient. The first digital forensic process model proposed contains four steps: Acquisition, Identification, Evaluation and Admission. Since then, numerous process models have been proposed to explain the steps of identifying, acquiring, analysing, storage, and reporting on the evidence obtained from various digital devices. In recent years, an increasing number of more sophisticated process models have been proposed. These models attempt to speed up the entire investigative process or solve various of problems commonly encountered in the forensic investigation. In the last decade, cloud computing has emerged as a disruptive technological concept, and most leading enterprises such as IBM, Amazon, Google, and Microsoft have set up their own cloud-based services. In the field of digital forensic investigation, moving to a cloud-based evidence processing model would be extremely beneficial and preliminary attempts have been made in its implementation. Moving towards a Digital Forensics as a Service model would not only expedite the investigative process, but can also result in significant cost savings - freeing up digital forensic experts and law enforcement personnel to progress their caseload. This paper aims to evaluate the applicability of existing digital forensic process models and analyse how each of these might apply to a cloud-based evidence processing paradigm.

研究动机与目标

• 评估数字取证过程模型的现状及其支持基于云的 DFaaS 范式的能力。
• 分析传统流程如何映射到云启用的证据处理和面向服务的工作流。
• 确定在调查工作流中采用 DFaaS 的潜在收益和挑战。

提出的方法

• 对已建立的数字取证过程模型就 DFaaS 要求进行评估和批评。
• 分析云计算对证据处理、处理和服务交付的影响。
• 对过程步骤（获取、识别、分析、存储、报告）如何与云基于处理对齐进行概念性评估。

实验结果

研究问题

• RQ1 现有数字取证过程模型与 Digital Forensics as a Service (DFaaS) 方法的对齐程度如何？
• RQ2 将数字取证工作流迁移到基于云的服务模型的潜在收益与局限性是什么？
• RQ3 哪些过程模型步骤在云启用的证据处理中影响最大？
• RQ4 在实践中实现基于云的 DFaaS 需要考虑哪些因素？

主要发现

• 现有过程模型提供基础结构，但需要为基于云的处理进行适应。
• DFaaS 可以通过云启用的证据处理加速调查并提供成本节省。
• 采用基于云的 DFaaS 需要在取证工作流中的效率、安全性和治理方面进行考虑。