Advanced Trace Pattern For Computer Intrusion Discovery

Selamat, S. R. and Yusof, R. and Sahib, S. and Mas'ud, Z. and Abdollah, M. F. and Zainal Abidin, Z. (2010) Advanced Trace Pattern For Computer Intrusion Discovery. Journal of Computing, 2 (6). pp. 200-2007. ISSN 2151-9617

Text 1006.4569[1].pdf - Published Version Restricted to Registered users only Download (627kB) | Request a copy

Abstract

The number of crime committed based on the malware intrusion is never ending as the number of malware variants is growing tremendously and the usage of internet is expanding globally. Malicious codes easily obtained and use as one of weapon to gain their objective illegally. Hence, in this research, diverse logs from different OSI layer are explored to identify the traces left on the attacker and victim logs in order to establish worm trace pattern to defending against the attack and help revealing true attacker or victim. For the purpose of this paper, it focused on malware intrusion and traditional worm namely sasser worm variants. The concept of trace pattern is created by fusing the attacker’s and victim’s perspective. Therefore, the objective of this paper is to propose a general worm trace pattern for attacker’s, victim’s and multi-step (attacker/victim)’s by combining both perspectives. These three proposed worm trace patterns can be extended into research areas in alert correlation and computer forensic investigation.

Item Type:	Article
Uncontrolled Keywords:	attacker, log, multi-step, trace pattern, victim.
Subjects:	Q Science > Q Science (General)
Divisions:	Faculty of Information and Communication Technology > Department of System and Computer Communication
Depositing User:	Dr. Robiah Yusof
Date Deposited:	05 Aug 2011 07:08
Last Modified:	19 Sep 2021 17:38
URI:	http://eprints.utem.edu.my/id/eprint/78
Statistic Details:	View Download Statistic

Actions (login required)

View Item