A system-awareness decision classifier to automated MSN forensics

Yin-Teshou Tsao Chu; Kuo-Pao Fan; Ya-Wen Cheng; Po-Kai Tseng

doi:10.1117/12.752591

10 September 2007 A system-awareness decision classifier to automated MSN forensics

Yin-Teshou Tsao Chu, Kuo-Pao Fan, Ya-Wen Cheng, Po-Kai Tseng

Proceedings Volume 6776, Broadband Access Communication Technologies II; 67760O (2007) https://doi.org/10.1117/12.752591
Event: Optics East, 2007, Boston, MA, United States

Abstract

Data collection is the most important stage in network forensics; but under the resource constrained situations, a good evidence collection mechanism is required to provide effective event collections in a high network traffic environment. In literatures, a few network forensic tools offer MSN-messenger behavior reconstruction. Moreover, they do not have classification strategies at the collection stage when the system becomes saturated. The emphasis of this paper is to address the shortcomings of the above situations and pose a solution to select a better classification in order to ensure the integrity of the evidences in the collection stage under high-traffic network environments. A system-awareness decision classifier (SADC) mechanism is proposed in this paper. MSN-shot sensor is able to adjust the amount of data to be collected according to the current system status and to keep evidence integrity as much as possible according to the file format and the current system status. Analytical results show that proposed SADC to implement selective collection (SC) consumes less cost than full collection (FC) under heavy traffic scenarios. With the deployment of the proposed SADC mechanism, we believe that MSN-shot is able to reconstruct the MSN-messenger behaviors perfectly in the context of upcoming next generation network.

Citation Download Citation

Yin-Teshou Tsao Chu, Kuo-Pao Fan, Ya-Wen Cheng, and Po-Kai Tseng "A system-awareness decision classifier to automated MSN forensics", Proc. SPIE 6776, Broadband Access Communication Technologies II, 67760O (10 September 2007); https://doi.org/10.1117/12.752591

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available