loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering
Finding the Evidence in Tamper-Evident Logs
May 22-May 22
ISBN: 978-0-7695-3171-7
Secure logs are powerful tools for building systems that must resist forgery, prove temporal relationships, and stand up to forensic scrutiny. The proofs of order and integrity encoded in these tamper-evident chronological records, typically built using hash chaining, may be used by applications to enforce operating constraints or sound alarms at suspicious activity. However, existing research stops short of discussing how one might go about automatically determining whether a given secure log satisfies a given set of constraints on its records. In this paper, we discuss our work on Querifier, a tool that accomplishes this. It can be used offline as an analyzer for static logs, or online during the runtime of a logging application. Querifier rules are written in a flexible pattern-matching language that adapts to arbitrary log structures; given a set of rules and available log data, Querifier presents evidence of correctness and offers counter examples if desired. We describe Querifier's implementation and offer early performance results.
Index Terms:
tamper evidence, secure logs, hash chaining, predicate logic, query processing
Citation:
Daniel Sandler, Kyle Derr, Scott Crosby, Dan S. Wallach, "Finding the Evidence in Tamper-Evident Logs," sadfe, pp.69-75, 2008 Third International Workshop on Systematic Approaches to Digital Forensic Engineering, 2008
Usage of this product signifies your acceptance of the Terms of Use.