A framework for cloud forensics evidence collection and analysis using security information and event management. Issue 16 (14th July 2016)

• Record Type: Journal Article
• Authors: Irfan, Muhammad; Abbas, Haider; Sun, Yunchuan; Sajid, Anam; Pasha, Maruf
• Is Part Of: Security and communication networks. Volume 9:Issue 16(2016)
• Page Start: 3790
• Page End: 3807
• Publication Date: 2016-07-14
• Subjects: cloud computing -- cloud forensics -- security information and event management -- virtual infrastructure; Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1538
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract: A primary feature of cloud computing is the provision of a variety of transparent services with efficient resource utilization. However, there are concerns with cloud computing in terms of the user's data privacy and security, especially in evidence collection for forensics analysis, because the tangible resources and hardware are out of reach for users who own the data. This paper presents a framework using security information and event management (SIEM), to address the issue of efficient evidence collection for crime investigation, such as that for cloud forensics, with respect to the cloud service provider. Indeed, evidence could be shared with cloud users when required. SIEM can be considered as a major player in terms of evidence collection in a virtualized environment. The proposed mechanism using SIEM focuses on passive attacks and provides a solution from the cloud administrator or service provider's point of view. The proposed framework can help in performing detailed cloud forensics in terms of efficient evidence building for crime investigations. Copyright © 2016 John Wiley & Sons, Ltd. Abstract : The study presents a framework, to address the issue of efficient evidence collection in cloud forensics for crime investigations, with respect to the cloud service provider, therefore providing a baseline for cloud providers to systematically collect and prepare evidence for cloud forensics and help in performing detailed cloud forensics in terms of efficient evidence building for crime investigations.