Tu, M., & Xue, S. (2014, June), Security Incident Tracking in Virtualized Linux Environment  Paper presented at 2014 ASEE Annual Conference & Exposition, Indianapolis, Indiana. 10.18260/1-2--23008

\bibitem{asee_peer_23008}
  Tu, M., \& Xue, S. (2014, June), \emph{Security Incident Tracking in Virtualized Linux Environment}
  Paper presented at 2014 ASEE Annual Conference \& Exposition, Indianapolis, Indiana.
  10.18260/1-2--23008

Manghui Tu and Shiming Xue.  "Security Incident Tracking in Virtualized Linux Environment".  2014 ASEE Annual Conference & Exposition, Indianapolis, Indiana, 2014, June.  ASEE Conferences, 2014.  https://peer.asee.org/23008 Internet.  13 Dec, 2024

\bibitem{asee_peer_23008}
  Manghui Tu and Shiming Xue.
  "Security Incident Tracking in Virtualized Linux Environment".
  \emph{2014 ASEE Annual Conference \& Exposition, Indianapolis, Indiana, 2014, June}.
  ASEE Conferences, 2014.
  https://peer.asee.org/23008 Internet.  13 Dec, 2024

@INPROCEEDINGS{asee_peer_23008
author = "Manghui Tu and Shiming Xue"
title = "Security Incident Tracking in Virtualized Linux Environment"
booktitle = "2014 ASEE Annual Conference \& Exposition"
year = "2014"
month = "June"
address = "Indianapolis, Indiana"
publisher = "ASEE Conferences"
note = {https://peer.asee.org/23008}
number = {10.18260/1-2--23008}
}

TY  - CPAPER
AB  -     Abstract —While virtualization has been a key technology that can be leveraged to achievebusiness benefits, virtualized environment provides a heaven for malicious and criminal activities.We can expect to witness the increase of illegal activities in virtualized environments asvirtualization gains its popularity. Meanwhile, numerous digital security and privacy laws andregulations have put business and organizations under obligations to prepare for auditing andlegal investigations. Therefore, businesses must prepare for the responsiveness to unforeseensecurity incidents in virtualized environments.    Forensic readiness of information systems can support future forensics investigation orauditing on external/internal attacks, internal sabotage and espionage, and business fraud. Toestablish forensics readiness, it is essential to identify which fingerprints are relevant and wherethey can be located, to determine whether they are logged in a forensically sound way andwhether all the needed fingerprints are available to reconstruct the events successfully. Also,fingerprint identification and locating mechanisms should be provided to guide potential forensicsinvestigation in the future. Furthermore, mechanisms should be established to automate thesecurity incident tracking and reconstruction processes. In this research, we will explore potentialsecurity exploitations and their corresponding fingerprints left in the virtualized Linuxenvironment. Attacks are modeled as augmented attack trees and then are conducted against asimulated virtualized environment, which is followed by a forensic investigation. Finally, anevidence tree is built for each attack based on fingerprints identified and located within thesystem.
AU  - Manghui Tu
AU  - Shiming Xue
CY  - Indianapolis, Indiana
DA  - 2014/06/15
PB  - ASEE Conferences
TI  - Security Incident Tracking in Virtualized Linux Environment
UR  - https://peer.asee.org/23008
DO  - 10.18260/1-2--23008
ER  -