QUT ePrints

ECF - Event correlation for forensics

Chen, Kevin, Clark, Andrew, De Vel, Olivier, & Mohay, George (2003) ECF - Event correlation for forensics. In First Australian Computer Network and Information Forensics Conference, 25 November 2003, Perth, Australia.

View at publisher

Abstract

The focus of the research described in this paper is on the nature of the event information provided in commonly available computer and other logs and the extent to which it is possible to correlate such event information despite its heterogeneous nature and origins. The strategic purpose of the research has been to develop a means by which a consolidated repository of such information can be constituted and then queried in order to provide an investigator with post hoc event correlation for forensics purposes (ECF). The paper provides an account of the log processing techniques utilized, and the nature of the database and query engine that have been developed in our current prototype and two examples of scenarios investigated and identified by the current prototype.

Impact and interest:

Citation countsare sourced monthly from Scopus and Web of Science® citation databases.

These databases contain citations from different subsets of available publications and different time periods and thus the citation count from each is usually different. Some works are not in either database and no count is displayed. Scopus includes citations from articles published in 1996 onwards, and Web of Science® generally from 1980 onwards.

Citations counts from the Google Scholar™ indexing service can be viewed at the linked Google Scholar™ search.

Full-text downloads:

617 since deposited on 14 Jun 2009
182 in the past twelve months

Full-text downloadsdisplays the total number of times this work’s files (e.g., a PDF) have been downloaded from QUT ePrints as well as the number of downloads in the previous 365 days. The count includes downloads for all files if a work has more than one.

ID Code: 21174
Item Type: Conference Paper
Keywords: event correlation, computer forensics
ISBN: 0729805425
Subjects: Australian and New Zealand Standard Research Classification > INFORMATION AND COMPUTING SCIENCES (080000) > COMPUTER SOFTWARE (080300) > Computer System Security (080303)
Divisions: Past > QUT Faculties & Divisions > Faculty of Science and Technology
Past > Institutes > Information Security Institute
Copyright Owner: Copyright 2003 The Authors
Deposited On: 15 Jun 2009 08:20
Last Modified: 29 Feb 2012 22:58

Export: EndNote | Dublin Core | BibTeX

Repository Staff Only: item control page