6th European Conference - Academic Conferences

Vincent Garramone and Daniel Likarish
To avoid creating too much predefined structure and possibly over-restricting the way users interact
with the site, a single, flat vocabulary of forensics-related terms was defined, as opposed to a
hierarchical one. This allows accommodation of user variance between how they define and use
terms. Furthermore, terms that refer to conceptual subsets of other terms are included in the
vocabulary because they are apparently often used independently of their parent terms in the
literature. For example, “Steganography” could be conceptually categorized as “hidden data
discovery”, but more than half of the papers examined explicitly mentioned the former term. This is an
example of a deterministic approach: allowing actual usage or terms to dictate taxonomy
development.
4.2 Dealing with added complexity
As the taxonomy structure becomes more complex, a tradeoff between the ease of content searching
and the difficulty of content submission is made. To offset the effects of PRISM’s more complex
taxonomy system, PRISM moderators will categorize content for developers. By offering this service,
content submission difficulty will be reduced, requiring only the submission of a link or the upload of
an archive to be posted.
4.3 A trial of the system
We used Regis University’s Computer Forensics course to evaluate the list of terms derived from the
literature (Table 1) and their ability to describe the computer forensics materials. The premise of the
course is to introduce the student to a wide variety of methods for investigating computer security
incidents. Each student takes on the role of a forensic analyst and each week the student is asked to
apply their skills to the analysis of many different types of data with different scenarios and tools. The
students have to create log entries detailing their findings as they work through the process of
analyzing the data for each scenario. First, we chose terms from the vocabulary that we felt
represented the lab content and learning intent. These lists, given in Table 2, column 2, represent the
values a content creator would assign to their own materials upon upload to the PRISM site. Next
those terms were compared with actual language used to describe the lab content in the course
syllabus, and a rating was given to the level of similarity between the available vocabulary terms and
those explicitly listed in the lab topic descriptions. A “Yes” value suggests that the terminology was
sufficiently similar to allow someone not familiar with the content of the lab to effectively classify data
using only a brief description. A “Partial” value means that one or more, but not all of the vocabulary
terms are reflected in the lab topic description. In this case, a material might not be classified under all
relevant terms, making it difficult to locate on the site. As an example, the lab described in the first row
of Table 2 might only be classified as an “Email Forensics” material since “Documentation” and “Legal
Process” are not explicitly mentioned in the description. Finally, a “No” designation is given if none of
the relevant vocabulary terms are present in the lab topic description.
Table 2: Summary of the weekly lab topics MSIA 680 Computer Forensics course and related PRISM
forensics vocabulary terms
Lab Topics from Syllabus Related PRISM Forensics Terms Match
Email Forensics and the Forensic Template. Also
Email Forensics
Partial
write a preface justifying the forensic approach.
Documentation
Legal Process
Snort alert data and Wireshark packet capture
Network Forensics
No
Network Security Podcast Report
Log Analysis
Live Response, Volatile & Nonvolatile Data, Cache
Dump
Live System Forensics Yes
RAPIER Tool Analysis. End with analysis of the
Log Analysis
No
Strength and Weakness of Forensic Tools and
Hidden Data Discovery
Processes
Documentation
Tool Validation*
Registry Examination and Tool usage Registry Analysis Yes
File Analysis Lab Hidden Data Discovery No
Active Malware Discovery (Trojans) and Memory
Examination
Rootkit Examination and research of additional
risks and methods of detection
79
Malware Detection
Hidden Data Discovery
Malware Detection
Yes
Yes