Building Evidence Graphs for Network Forensics Analysis
Abstract
In this paper, we present techniques for a network forensics analysis mechanism that includes effective evidence presentation, manipulation and automated reasoning. We propose the evidence graph as a novel graph model to facilitate the presentation and manipulation of intrusion evidence. For automated evidence analysis, we develop a hierarchical reasoning framework that includes local reasoning and global reasoning. Local reasoning aims to infer the roles of suspicious hosts from local observations. Global reasoning aims to identify group of strongly correlated hosts in the attack and derive their relationships. By using the evidence graph model, we effectively integrate analyst feedback into the automated reasoning process. Experimental results demonstrate the potential and effectiveness of our proposed approaches
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In-KG applications include graph refinement (e.g., completion and error detection), triple/entity classification, and entity resolution. Out-of-KG applications include relation extraction, question answering, and recommendation, which are related to specific AIoT scenarios, such as network forensics analysis in smart security [224], smart assistants in smart healthcare and agriculture [39], [225],
“InKG applications include graph refinement (e.g., completion and error detection), triple/entity classification, and entity resolution. Out-of-KG applications include relation extraction, question answering, and recommendation, which are related to specific AIoT scenarios, such as network forensics analysis in smart security [224], smart assistants in smart healthcare and agriculture [39], [225],”
From Empowering things with intelligence: a survey of the progress, challenges, and opportunities in artificial intelligence of things (2021) · cites this paper as [224]
Cites
Alert correlation in a cooperative intrusion detection framework
Cuppens, F., & Miège, A. (2005) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/secpri.2002.1004372 · Cited by 697 · see citing works
Probabilistic Alert Correlation
Valdes, A., & Skinner, K. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45474-8_4 · Cited by 635 · see citing works
Aggregation and Correlation of Intrusion-Detection Alerts
Debar, H., & Wespi, A. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45474-8_6 · Cited by 618 · see citing works
Constructing attack scenarios through correlation of intrusion alerts
Ning, P., Cui, Y. F., & Reeves, D. S. (2002) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/586110.586144 · Cited by 496 · see citing works
Snoeren, A. C., Partridge, C., Sanchez, L. A., Jones, C. E., Tchakountio, F., Schwartz, B., Kent, S., & Strayer, W. T. (2002) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2002.804827 · Cited by 450 · see citing works
Zhang⋆, Y., & Paxson, V. (2000) · Cited by 382 · see citing works
A revised taxonomy for intrusion-detection systems
Debar, H., Daciér, M., & Wespi, A. (2000) · Annals of Telecommunications · doi:10.1007/bf02994844 · Cited by 358 · see citing works
M2D2: A Formal Data Model for IDS Alert Correlation
Morin, B., Mé, L., Debar, H., et al. (2002) · Lecture notes in computer science · doi:10.1007/3-540-36084-0_7 · Cited by 249 · see citing works
Fusing A Heterogeneous Alert Stream Into Scenarios
Dain, O., & Cunningham, R. K. (2002) · Advances in information security · doi:10.1007/978-1-4615-0953-0_5 · Cited by 222 · see citing works
Finding a Connection Chain for Tracing Intruders
Yoda, K., & Etoh, H. (2000) · Lecture notes in computer science · doi:10.1007/10722599_12 · Cited by 175 · see citing works
Constructing attack scenarios through correlation of intrusion alerts
Ning, P., Cui, Y., & Reeves, D. S. (2002) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/586143.586144 · Cited by 143 · see citing works
Fuzzy cognitive maps for decision support in an intelligent intrusion detection system
Siraj, A. H., Bridges, S. M., & Vaughn, R. B. (2002) · doi:10.1109/nafips.2001.944405 · Cited by 113 · see citing works
Rule based fuzzy cognitive maps and fuzzy cognitive maps-a comparative study
Carvalho, J. P., & Tome, J. A. B. (2003) · International Conference of the North American Fuzzy Information Processing Society (NAFIPS) · doi:10.1109/nafips.1999.781665 · Cited by 88 · see citing works
Building Scenarios from a Heterogeneous Alert Stream
Dain, O., & Cunningham, R. K. (2001) · Cited by 87 · see citing works
Rule Based Fuzzy Cognitive Maps: Fuzzy Causal Relations
Carvalho, J. P., & Tome, J. A. B. (2002) · Cited by 78 · see citing works
ForNet: A Distributed Forensics Network
Shanmugasundaram, K., Memon, N. D., Savant, A., et al. (2003) · Cited by 68 · see citing works
ForNet: A Distributed Forensics Network
Shanmugasundaram, K., Memon, N. D., Savant, A., et al. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45215-7_1 · Cited by 56 · see citing works
Daniels, T. E., & Spafford, E. H. (2002) · Cited by 12 · see citing works
Self-citationLee, W., Mé, L., & Wespi, A. (2001) · Medical Entomology and Zoology · Cited by 4 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Zhang, J., & Tao, D. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3039359 · Cited by 774 · see citing works
- Authors
- Wang, W., & Daniels, T. E.
- Affiliations
- Iowa State University (US)
- Venue
- 21st Annual Computer Security Applications Conference (ACSAC'05)
- Publisher
- IEEE
- Published
- 2006-01-05
- Pages
- 254-266
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W2159447717
- Cited by
- 44
- References
- 19
- Citations by year
- 2025: 1 · 2024: 1 · 2022: 1 · 2021: 1 · 2020: 3 · 2019: 1 · 2018: 1 · 2017: 2 · 2015: 3 · 2014: 2 · 2012: 1
- FWCI
- 5.11
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- network forensics, evidence graph, automated reasoning, hierarchical reasoning, local reasoning, global reasoning, evidence presentation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
