TY - GEN
T1 - A forensically robust data acquisition from a 10G line-rate network
AU - Lee, Jooyoung
AU - Choi, Sunoh
AU - Choi, Yangseo
AU - Kim, Jonghyun
AU - Kim, Ikkyun
N1 - Publisher Copyright:
© 2016 IEEE.
PY - 2016/11/30
Y1 - 2016/11/30
N2 - De-duplication, which is a technology that can store data by removing redundant data, continues to receive a lot of attention. Because it reduces the storage required for writing tremendous data, as well as relatively lessens the transmission time and network utilization when data is transmitted. It is also required for the cyber blackbox which records network traffic and analyzes the causes of cyber incident over the network because the cyber blackbox should urgently address the storage issue to provide forensically robust acquisition of traffic. As an approach to the problem, we propose the EvidenceLock and our de-duplication method for continuously securing the storage to record the traffic. Next, the efficiency of the de-duplication module will be evaluated, and then the performance of the cyber blackbox when integrated with the de-duplication module will be measured. Finally, we'll discuss the results and present further works.
AB - De-duplication, which is a technology that can store data by removing redundant data, continues to receive a lot of attention. Because it reduces the storage required for writing tremendous data, as well as relatively lessens the transmission time and network utilization when data is transmitted. It is also required for the cyber blackbox which records network traffic and analyzes the causes of cyber incident over the network because the cyber blackbox should urgently address the storage issue to provide forensically robust acquisition of traffic. As an approach to the problem, we propose the EvidenceLock and our de-duplication method for continuously securing the storage to record the traffic. Next, the efficiency of the de-duplication module will be evaluated, and then the performance of the cyber blackbox when integrated with the de-duplication module will be measured. Finally, we'll discuss the results and present further works.
KW - cyber black box
KW - Deduplication
KW - network forensics
KW - Network traffic gathering
UR - https://www.scopus.com/pages/publications/85015776899
U2 - 10.1109/ICTC.2016.7763402
DO - 10.1109/ICTC.2016.7763402
M3 - Conference paper
AN - SCOPUS:85015776899
T3 - 2016 International Conference on Information and Communication Technology Convergence, ICTC 2016
SP - 1188
EP - 1190
BT - 2016 International Conference on Information and Communication Technology Convergence, ICTC 2016
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2016 International Conference on Information and Communication Technology Convergence, ICTC 2016
Y2 - 19 October 2016 through 21 October 2016
ER -