2016年
A Log-structured Block Preservation and Restoration System for Proactive Forensic Data Collection in the Cloud
PROCEEDINGS OF 2016 11TH INTERNATIONAL CONFERENCE ON AVAILABILITY, RELIABILITY AND SECURITY, (ARES 2016)
- ,
- 開始ページ
- 355
- 終了ページ
- 364
- 記述言語
- 英語
- 掲載種別
- 研究論文(国際会議プロシーディングス)
- DOI
- 10.1109/ARES.2016.8
- 出版者・発行元
- IEEE
Preservation and data collection in cloud environments are difficult because forensic data are volatile and they are scattered in many servers. This paper describes a novel surveillance mechanism for virtual block devices on IaaS cloud environments. We first describe some related work on backup applications, versioning file systems, and virtual machine introspection systems that can be applied to cloud forensics. The proposed log-structured block preservation and restoration system can be used for recording cloud consumers' write operations on virtual block devices and for restoring the state of a virtual block device at an arbitrary point in time. This paper presents a design and an implementation of the proposed system by using Xen hypervisor. The prototype implementation achieved better read and write performance compared to the baseline driver provided by Xen when we ran four or more virtual machines simultaneously. This paper shows two forensic applications for preserved data blocks: a file tracking application and a novel diff command that supports time travel.
- リンク情報
-
- DOI
- https://doi.org/10.1109/ARES.2016.8
- DBLP
- https://dblp.uni-trier.de/rec/conf/IEEEares/HiranoO16
- J-GLOBAL
- https://jglobal.jst.go.jp/detail?JGLOBAL_ID=201602287248637905
- Web of Science
- https://gateway.webofknowledge.com/gateway/Gateway.cgi?GWVersion=2&SrcAuth=JSTA_CEL&SrcApp=J_Gate_JST&DestLinkType=FullRecord&KeyUT=WOS:000391214400044&DestApp=WOS_CPL
- URL
- http://dblp.uni-trier.de/db/conf/IEEEares/ares2016.html#conf/IEEEares/HiranoO16
- URL
- http://doi.ieeecomputersociety.org/10.1109/ARES.2016.8
- ID情報
-
- DOI : 10.1109/ARES.2016.8
- DBLP ID : conf/IEEEares/HiranoO16
- J-Global ID : 201602287248637905
- Web of Science ID : WOS:000391214400044