Analyzing multiple logs for forensic evidence 5

Transcription

1 digital ivstigati 4S (2007) S82 S91 availabl at jural hmpag: Aalyzig multipl lgs fr frsic vidc 5 Ali Rza Arasth, Murad Dbbabi*, Assaad Sakha, Mhamd Salh Cmputr Scurity Labratry, Ccrdia Istitut fr Ifrmati Systms Egirig, Ccrdia Uivrsity, Mtral, Qubc, Caada abstract Kywrds: Frsic aalysis Lg aalysis Frmal mthds Mdl chckig Lggig systms Lg crrlati Ifrmati strd i lgs f a cmputr systm is f crucial imprtac t gathr frsic vidc f ivstigatd actis r attacks. Aalysis f this ifrmati shuld b rigrus ad crdibl, hc it lds itslf t frmal mthds. W prps a mdl chckig apprach t th frmalizati f th frsic aalysis f lgs. A st f lgs is mdld as a tr whs labls ar vts xtractd frm th lgs. I rdr t prvid a structur t ths vts, w xprss ach vt as a trm f algbra. Th sigatur f th algbra is carfully chs t iclud all rlvat ifrmati cssary t cduct th aalysis. Prprtis f th mdl, attack scaris, ad vt squcs ar xprssd as frmulas f a lgic havig dyamic, liar, tmpral, ad mdal charactristics. Mrvr, w prvid a tablau-basd prf systm fr this lgic up which a mdl chckig algrithm ca b dvlpd. W us ur mdl i a cas study t dmstrat hw vts ladig t a SYN attack ca b rcstructd frm a umbr f systm lgs. ª 2007 DFRWS. Publishd by Elsvir Ltd. All rights rsrvd. 1. Itrducti ad mtivati Attacks IT systms ar icrasig i umbr, ad sphisticati at a alarmig rat. Ths systms w rag frm srvrs t mbil dvics ad th damag frm such attacks is stimatd i billis f dllars. Hwvr, du t th brdrlss atur f cybr attacks, may crimials/ffdrs hav b abl t vad rspsibility du t th lack f supprtig vidc t cvict thm. I this ctxt, cybr frsics plays a majr rl by prvidig scitifically prv mthds t gathr, prcss, itrprt, ad us digital vidc t brig a cclusiv dscripti f cybr crim activitis. Th dvlpmt f frsics IT slutis fr law frcmt has b limitd. Althugh utstadig rsults hav b achivd fr frsically sud vidc gathrig, littl has b d th autmatic aalysis f th acquird vidc. Furthrmr, limitd ffrts hav b mad it frmalizig th digital frsic scic. I may cass, th frsic prcdurs mplyd ar cstructd i a ad hc mar that impds th ffctivss r th itgrity f th ivstigati. I this papr, w ctribut with a autmatic ad frmal apprach t th prblm f aalyzig lgs with th purps f gathrig frsic vidc. O f th mst cmm surcs f vidc that a ivstigatr shuld aalyz is lggd vts frm th activitis f th systm that is rlatd t th icidt i qusti. Idd, havig th lgs frm all systm vts durig th icidt will rduc th prcss f frsics aalysis t vt rcstructi. Hwvr, lg aalysis dpds largly th aalyst s skills ad xpric t ffctivly dciphr cmplx lg pattrs ad dtrmi what ifrmati is prtit ad usful t supprt th cas at had. Dspit th paramut imprtac f this aspct, t much rsarch ffrt has b ddicatd t th autmati f frsic lg aalysis. Th mai 5 Th rsarch rprtd i this papr is th rsult f a fruitful cllabrati with Bll Caada udr th PROMPT Qubc rsarch partrship prgram. * Crrspdig authr. addrsss: a_arast@ciis.ccrdia.ca (A.R. Arasth), dbbabi@ciis.ccrdia.ca (M. Dbbabi), a_sakha@ciis.ccrdia.ca (A. Sakha), m_salh@ciis.ccrdia.ca (M. Salh) /$ s frt mattr ª 2007 DFRWS. Publishd by Elsvir Ltd. All rights rsrvd. di: /j.dii

2 digital ivstigati 4S (2007) S82 S91 S83 itt f this papr is t itrduc a frmal ad autmatic lg aalysis tchiqu. Th advcatd apprach catrs fr: Mdlig f lg vts ad lgical rprstati f prprtis that shuld b satisfid by th tracs f systm vts. Frmal ad autmatic aalysis f th lgs lkig fr a spcific pattr f vts r vrifyig a particular frsic hypthsis. I spit f th fw rsarch rsults frmal ad autmatic aalysis f frsic ad digital vidc, thr ar sm imprtat prpsals that w dtail hraftr. Currt rsarch ffrts cybr frsic aalysis ca b catgrizd it basli aalysis, rt caus aalysis, cmm vulrability aalysis, timli aalysis, ad smatic itgrity chck aalysis. Th basli aalysis, prpsd i Mr ad Baily (2003), uss a autmatd tl that chcks fr diffrcs btw a basli f th saf stat f th systm ad th stat durig th icidt. Th wrk prstd i Stphs (2003) prpss a apprach t pst-icidt rt caus aalysis f digital icidts thrugh a sparati f th ifrmati systm it diffrt scurity dmais ad mdlig th trasactis btw ths dmais. Cmm vulrability aalysis (Tabl Ntwrk Scurity, 2007) ivlvs sarchig thrugh a databas f cmm vulrabilitis ad ivstigatig th cas accrdig t th rlatd past ad kw vulrabilitis. Th timli aalysis apprach (Hsmr, 1998) csists f aalyzig lgs, schdulig ifrmati, ad mmry t dvlp a timli f th vts that ld t th icidt. Fially, th smatic itgrity chckig apprach (Stallard ad Lvitt, 2003) uss a dcisi gi that is dwd with a tr t dtct smatic icgruitis. Th dcisi tr rflcts pr-dtrmid ivariat rlatiships btw rdudat digital bjcts. Gladyshv ad Patl (2004) prpsd a frmalizati f digital vidc ad vt rcstructi basd fiit stat machis. I his wrk, th bhavir f th systm is mdld as a stat machi ad a rcursiv mdl chckig prcdur is prpsd t vrify th admissibility f a frsic hypthsis. Hwvr, i th ral wrld, mdlig th bhavir f a cmplx systm such as a pratig systm as a stat machi diagram is burdsm ad smtims impssibl t achiv bcaus f cmplxity issus. Othr rsarch frmalizd frsic aalysis iclud th frmalizati f vt tim bidig i digital ivstigati (Gladyshv ad Patl, 2005; Liglad ad Krigs, 2004), which prpss a apprach t cstructig frmalizd frsic prcdurs. Nvrthlss, th scic f digital frsics still lacks a frmalizd apprach t lg aalysis. As fr lg aalysis ad crrlati, sm rsarch has b d alrt crrlati, which ca b classifid it fur catgris (Xu, 2007): Similarity basd apprachs (Cupps, 2001; Julisch, 2003; Staifrd t al., 2002; Valds ad Skir, 2001), which grup th alrts accrdig t th similarity btw alrt attributs. Prdfid attack scari basd apprachs (Dbar ad Wspi, 2001; Mri ad Dbar, 2003), which dtct attacks accrdig t wll-dfid attack scaris. Hwvr, thy cat discvr vl attack scaris. Pr-/pst-cditi basd apprachs (Cupps ad Mig, 2003; Nig t al., 2002; Tmplt ad Lvitt, 2000) that match th pst-cditi f a attack t th pr-cditis f athr attack. Th multipl ifrmati surcs basd apprachs (Mri t al., 2002; Prras t al., 2002; Ygswara t al., 2004) that ar ccrd with distributd attack discvry. Hwvr, ths apprachs ar maily ccrd with crrlati, ad itrusi dtcti, whil frmal lg aalysis ad hypthsis vrificati is f paramut imprtac t frsic scic. As a xampl, ivariat prprtis f th systm cat b mdld ad aalyzd thrugh th abv apprachs. Th absc f a satisfactry ad a gral mthdlgy fr frsic lg aalysis has rsultd i ad hc aalysis tchiqus such as lg aalysis (Pikari ad Chuvaki, 2004) ad pratig systm-spcific aalysis (Krus ad Hisr, 2002). I this papr, w prps a w apprach fr lg aalysis that is basd cmputatial lgic ad frmal autmatic vrificati. W start by dvlpig a mdl f lgs basd tracs f vts. Each vt is actually a abstract viw f a pic f ifrmati strd i th lg. Th structur f a vt is carfully chs t cvy th cssary ifrmati dd fr th aalysis. T this d, vts ar rprstd as trms f a multi-srtd trm algbra whs prati symbls ar chs such that thy faithfully cvy th ifrmati strd i th actual vts strd i th lg. Fr istac th trm DltFil(F, U ) with prati DltFil : Fil Usr/Bl rprsts th dlti f fil F by a usr U. Usig this apprach, w ca ras abut lg vts irrspctiv f th spcific sytax f th lg, which is usually diffrt fr diffrt systms. Each lg i th systm is thus mdld as a trac f trms. Mrvr, i th prsc f svral lgs t which ifrmati is writt ccurrtly, th whl lggig systm is mdld as a tr that rprsts pssibl diffrt itrlavigs f vts frm th lgs. T xprss prprtis f th mdl, w rsrt t a tmpral, dyamic, mdal ad liar lgic. This lgic is a accmmdatd vrsi f ADM lgic that has b iitially prpsd i Adi t al. (2003). Th mtivati bhid this chic is that ADM cms with may faturs ad attributs that mak it vry suitabl fr what w itd t achiv sic it dals with prprtis f tracs. Th mdifid vrsi that w prst i this papr dals with prprtis f trms ad trs. Als, ADM is vry cmpact i its sytax, lgat ad frmal i its smatics ad high i trms f xprssivss. Actually, it is tmpral (thrugh th us f mdal pratrs), dyamic (thrugh th us f pattrs as argumts i th mdalitis) ad liar (by allwig mdl mdificatis i th lgic smatics). Bsids, it cms with fixpit pratrs à la mdal m-calculus, which allws fr th spcificati f prprtis that ar fiit cdigs f ifiit lgical frmulas. All this xprssivss is xtrmly usful i capturig frsic prprtis, hypthss ad systm ivariats. Mrvr, w prst a tablau-basd prf systm that dfis a cmpsitial mdl chckig algrithm. All ths faturs prvid a rigrus ad prvabl lgical supprt, which is a cssity fr a ivstigati t b admittd i curts f law. This papr is rgaizd i fiv sctis. I Scti 2, w prst ur apprach t th frmal mdlig f lgs. Scti 3

3 S84 digital ivstigati 4S (2007) S82 S91 is dvtd t th lgic usd t xprss prprtis f th mdl. Scti 4 ctais a xampl f hw lgs ca b mdld ad thir prprtis xprssd i ur framwrk. Scti 5 prsts a cas study dalig with a SYN attack. Fially, cclusis ad futur wrk ar discussd i Scti 6. trms. A substituti is grally xtdd t a hmmrphism i th fllwig way: q x : X S /T S ðs; XÞ is xtdd t ~q x : T S ðs; XÞ/T S ðs; XÞ ~ qx ðcþ ¼c whr c is a cstat ~ qx ðfðt 1 ; t 2 ;.; t ÞÞ ¼ f ~qx ðt 1 Þ; ~ q x ðt 2 Þ;.; ~ q x ðt Þ 2. Mdl fr lgs I this scti, w dscrib ur mdl fr systm lgs which is a tr f algbraic trms. First, w brifly rcall ccpts frm uivrsal algbra (Wchlr, 1992) th w prst th mdl. A multi-srtd sigatur S is a pair CS; FD, whr S is a st f srts ad F is a st f pratr symbls. Fr ach pratr symbl f, th fucti arity : F/N maps f t a atural umbr calld th arity f f. Mrvr, fr ay pratr symbl f F f arity, w hav th fuctis dmðfþ S ad cdðfþ S, whr S 0 ¼ Ø, S 1 ¼ S, ad S þ1 ¼ S S. Fr a pratr symbl f, whr dm( f ) ¼ S 1 S 2 / S, ad cd( f ) ¼ S, f is calld a pratr f srt S ad w writ f : S 1 S 2 / S /S. I th cas whr arity( f ) ¼ 0, ad cd( f ) ¼ S, f is calld a cstat symbl f srt S, th st f cstats f srt S is writt C S. Als, fr ach srt S, w dfi a ifiit st X S f cutabl lmts calld variabls f srt S, such that X S XC S ¼ Ø. Fr a crtai sigatur S, w dfi th st T P ðs; XÞ f fr trms f srt S iductivly as fllws (th symbl 0 is fr lgic implicati): ðx S WC S Þ4T S ðs; XÞ f : S 1 S 2 / S /S0fðt 1 ;.; t Þ T S ðs; XÞ whr ach t i is a trm f srt S i Th st T P ðxþ f fr trms vr th sigatur S is dfid as W s S T P ðs; XÞ. Th st f grud trms T P 4T P ðxþ icluds all trms that d t ctai ay variabls. A algbra A f a sigatur S (calld a S-algbra) is a pair CA; F A D. Th S-algbra A assigs t ach srt S i th sigatur S a st A S calld th carrir f srt S, whr A ¼ W S S A S. Als fr ach pratr symbl f : S 1 S 2 / S /S, A assigs a fucti f A : A S1 A S2. A S /A S, F A is th st f all fuctis f A. A hmmrphism is a fucti btw S-algbras that rsrvs thir structur. If A ad B ar tw S-algbras havig th sam sigatur, h : A/B is a calld a S-hmmrphism iff: cf F$h f A ða 1 ; a 2 ;.; a Þ ¼ f B ðhða 1 Þ; hða 2 Þ;.; hða ÞÞ A S-algbra prvids a itrprtati fr a crtai sigatur, whr ach srt is itrprtd as a st ad ach pratr symbl as a fucti. Th fr trm algbra T S ðxþ assciatd with a sigatur S is a spcial kid f S-algbra i which ach carrir st A S f th srt S ad ach fucti f T SðXÞ : A S1 A S2 / A S /A S ar dfid as: ct$t T S ðs; XÞ5t A S f T SðXÞðt 1 ; t 2 ;.; t Þ¼fðt 1 ; t 2 ;.; t Þ whr t i A Si Th trm algbra T S ca b btaid frm T S ðxþ by rmvig ay trms that ctai variabls. A substituti q x : X S /T S ðs; XÞ is a mappig frm variabls t trms f th sam srt. A grud substituti maps variabls t grud Usually w writ q x fr ~ q x. W viw a lg as a squc f lg tris, ach try csists f a crtai trm t f a trm algbra T S. Th sigatur S is chs such that ach vt mitrd by th lggig systm ca b rprstd as a trm t T S. W dfi th lg mdl L as a fiit squc vr T S, i.., L T S. I thr wrds, th lg mdl is a squc that rprsts lggd vts i th systm rdrd tmprally. Graphically, th lg mdl is a trac whs dgs ar labld by trms f T S. Hwvr, may systms may hav mr tha lg, whr ach lg is ddicatd t a crtai catgry f vts. Mrvr, w may b facd by situatis whr it is cssary t ispct lgs frm diffrt machis,.g., i th cas f a twrk. I rdr t mdl a lg systm csistig f mr tha lg, ad i th prsc f ccurrt actis i th lgs, th mdl bcms a tr. T illustrat this, assum w hav a squc f actis a$b i lg L 1 ad athr squc c$d i lg L 2. Tmprally, w assum that a ccurrd first th c, th b ad d ccurrd at th sam tim. Th cmbid trac f th tw lgs will b a tr L, which is th fllwig st f tracs L ¼ {a, a$c, a$c$b, a$c$d, a$c$b$d, a$c$d$b}, i.., w csidrd th tw pssibl itrlavigs f th ccurrt vts b ad d. Th sam basic ida is usd t cstruct sychrizati trs f prcss calculi. W dfi th itrlavig f tw lgs L 1 ad L 2 t b L 1 kl 2 4ðT S1 WT S2 Þ which rprsts all pssibl itrlavigs f ccurrt vts frm bth lgs. Hr, w assumd that ach lg has its w sigatur. Th dfiiti ca b asily gralizd i th cas f a fiit umbr f lgs. Dfid this way, a lg systm f mr tha lg is graphically rprstd as a tr whs brachs ar labld by trms f trm algbras. Our mdl csists f this lg tr alg with a mappig rig that maps trms t thir rspctiv lgs. Fr istac, i th xampl abv, w hav rig(a) ¼ L 1. Fr a squc s L, w dfi s^p, whr P is a st f idividual lgs, t b th squc btaid frm s by rmvig ay trms t, such that rigðtþ;p. W vrlad th ^ pratr by dfiig L^P t b th st f s^pjs Lg. I th xampl abv, w hav: L ^ L 1 ¼ {a, a$b}, L ^ L 2 ¼ {c, c$d}, ad L ^ {L 1, L 2 } ¼ L. W t hr that L^P is als a tr. 3. Lgic fr lg prprtis I this scti, w prst a w lgic fr th spcificati f prprtis f th lg mdl. Th lgic is basd idas frm th ADM lgic (Adi t al., 2003), with sm basic diffrcs. First, ADM is trac-basd whil th lgic w prst is trbasd, thrfr w ca quatify xisttially ad uivrsally vr tracs. Mrvr, this givs us th pprtuity t xprss brachig-tim prprtis. Scd, w add a sub-tr pratr that will allw us t quatify with rspct t idividual lgs,.g., all squcs f th tr that ctai vts frm lgs L 1 ad L 2 ly. Third, th actis i ADM ar atmic

4 digital ivstigati 4S (2007) S82 S91 S85 symbls whras th actis i ur lgic hav a structur sic thy ar trms f a trm algbra. Th chic f ADM i th first plac is mtivatd by th fact that is basd mdal m-calculus with its kw xprssiv pwr. Mst imprtatly, th prprtis w wuld lik t xprss ar vr tracs f th lg tr mdl, ADM dals with tracs ad has all th xprssiv pwr w d fr this task icludig sm cutig prprtis (Adi t al., 2003) Sytax Bfr prstig th sytax f frmulas, w prst th ccpt f a squc pattr r. A squc pattr has th fllwig sytax: r T¼ ja$rjx r $r at ¼ tjqts (1) Hr a rprsts a trm i T S ðxþ ad has th frm t r QtS. Ituitivly, a rprsts a trm i th lg tr mdl, whr this trm is ithr t r a trm ctaiig tðqtsþ. Th trm QtS is dfid as t r f(t 1, t 2,.,t ) such that dt i $t i ¼ QtS. Hr f S is ay fucti symbl i th sigatur f th algbra. Th squc variabl x r rprsts a squc f trms f zr r ay fiit lgth, th subscript r is addd t avid cfusi with trm variabls x f th mssag algbra. Th sts f squc variabls ad trms i r ar writt var(r) ad trm(r), rspctivly. Mrvr, fr ay pattr r, th symbl rj i rprsts th variabl r mv at psiti i f r, whr i {1,.,}. W dfi th substituti q r : varðrþ/t S that maps variabls x r i a squc pattr t squcs f trms, this is t t b cfusd with th substituti q x that maps variabls isid mssags it trms f T S (X ). W dfi th prdicat match(s, r, q m, q r ), which is tru wh a squc s ¼ s 1 $s 2.s i th lg tr matchs a pattr r, is th mpty squc: matchð; ; q m ; q r Þ¼tru matchðs; ; q m ; q r Þ¼fals if ss matchðs; a$r; q m ; q r Þ¼ðs 1 ¼ aq m Þ^matchðs 2.s ; r; q m ; q r Þ matchðs; x r $r; q m ; q r Þ¼ dj $ x r q r ¼ s 1.s j ^ match s jþ1.s ; r; q m ; q r A substituti q : R/T S frm pattrs t squcs f trms, whr q ¼ q m W q r, is dfid as fllws: qðþ ¼ qða$rþ ¼q m ðaþ$qðrþ qðx r $rþ ¼q r ðx r Þ$qðrÞ W will fllw th usual tati fr substitutis ad writ rq fr q(r). Frm th dfiitis f th prdicat match ad th substituti q abv, w tic that th cditi fr a match btw a pattr ad a squc is th xistc f r mr substitutis q, w ca thrfr writ th prdicat as match(s, r, q). Th sytax f a frmula f is xprssd by th fllwig grammar: 4 T¼ Zj:4j4 1^4 2 j½r 1 Ir 2 Š4jCCLDD4jZ$4 (2) W rquir th fllwig tw sytactic cditis: I [r 1 I r 2 ]: ci$(r 1 j i var(r 1 ) 5 r 1 j i ¼ r 2 j i ) ^ (r 1 j i trm(r 1 ) 5 r 1 j i ¼ r 2 j i r 2 j i ¼ ;). I Z$4, ay fr Z i 4 appars udr th scp f a v umbr f gatis. Th first cditi abv mas that r 2 is btaid frm r 1 by rplacig sm f th trms f r 1 by th dummy symbl ;, whr q(;) ¼ ;, i.., squc variabls f r 1 ad r 2 ar th sam. This cditi is cssary t sur that r 1 q ad r 2 q hav th sam lgth. Hc, i a tr mdl L, ifr 1 q L, w ca rplac r 1 q by r 2 q ad still gt a tr, which is writt L 0 ¼ L[r 2 q/r 1 q]. Th scd cditi is cssary fr th smatic itrprtati fucti as will b xplaid i th smatics scti. Ituitivly, a lg tr mdl L satisfis th frmula [r 1 I r 2 ]4 if fr all squcs s L that matchs r 1, i.., r 1 q ¼ s, wh s is mdifid t match r 2 (by rmvig sm f its trms) th s 0 ¼ r 2 q satisfis 4. Th mdl L satisfis CCLDD4, whr L is a st f lgs, if L^L satisfis 4. Th rst f th frmulas hav thir usual maigs i mdal m-calculus (Clavlad, 1990) Smatics A frmula i th lgic is itrprtd vr a lg tr. Giv a crtai lg tr L, ad a virmt that maps frmula variabls t squcs i L, th smatic fucti E4F L maps a frmula 4 t a st f squcs S 4 L that satisfy this frmula. EZF L ¼ ðzþ E:4F L ¼ LyE4FL E4 1^4 2 F L ¼ E4 1F L XE4 2F L E½r 1 Ir 2 Š4F L ¼ s Ljcq$matchðs; r 1 ; qþ0s whr s 0 ¼ r 2 q ad L 0 ¼ L½r 2 q=r 1 qš ECCLDD4F L ¼ðL^LÞXE4FL EZ$4F L S4LjS4E4F ¼ W L ½Z1SŠ 0 E4F L0 Frm th smatic quatis abv it ca b s that th maig f th rcursiv frmula Z$4 is tak t b th gratst fixpit f a fucti f : 2 L /2 L, whr fðsþ ¼E4F L ½Z1SŠ. Th fucti f is dfid vr th lattic ð2 L ; 4; W; XÞ, th sytactic cditi 4 (X appars udr th scp f a v umbr f gatis) surs that f(s ) is mt (Clavlad, 1990) ad hc has a gratst fixpit. W us th fllwig shrthad tatis: :ð:4 1^:4 2 Þh : h :½r 1 Ir 2 Š:4hCr 1 Ir 2 D4 :Z$:4½:Z=ZŠhmZ$4 W als dfi Z$Z t b tt, whr EttF L ¼ L ad mz$z t b ff, whr EffF L ¼ Ø. I th fllwig, w prv sm imprtat rsults rgardig th lgic. Lmma 3.1. E4½j=ZŠF L ¼ E4FL ½Z1EjF L Š Prf. Th prf is d by structural iducti vr 4. Bas cas: 4 ¼ Z Ej=ZF L ¼ EjFL But: EZF L ¼ ðzþ, sej=zfl ¼ EZFL ½Z1EjF L Š. ; (3)

5 S86 digital ivstigati 4S (2007) S82 S91 W dmstrat tw cass ad th thr cass ca b asily prvd: Cas 1. 4 ¼ Z$4 0 ad X is fr i 4 E4½j=XŠF L S4L ¼ W S4E4 0 ½j=XŠF L ½Z1SŠ By iducti hypthsis: E4½j=XŠF L S4L ¼ W S4E4 0 F L ½Z1SŠ ½X1EjF L ½Z1SŠ Š Sic j ds t ctai Z as fr variabl, which ca b assurd by ramig f th bud variabl Z, w hav: E4½j=XŠF L ¼ W S4LjS4E4 0 ½j=XŠF L ½Z1SŠ½X1EjF L Š E4½j=XŠF L ¼ E4FL ½X1EjF L Š Cas 2. 4 ¼ [r 1 I r 2 ]4 0 E4½j=ZŠF L ¼ s Ljcq$match ðs; r 1 ; qþ0s 0 E4 0 ½j=ZŠF L0 By iducti hypthsis: E4½j=ZŠF L ¼ s Ljcq$matchðs; r 1 ; qþ0s 0 E4 0 F L0 ½Z1EjF L Š E4½j=ZŠF L ¼ E4FL ½Z1EjF L Š, As a rsult, w hav EvZ$4F L ¼ E4½vZ$4=ZŠFL. This fllws frm th fact that EvZ$4F L ¼ E4FL ½Z1TŠ, whr T ¼ W f S4LjS4 E4F L ½Z1SŠ ¼ EvZ$4F L. W ca w prv that th smatics f th xprssi mz$4 dfid arlir as :Z$:4[:Z/Z] is th last fixpit f th fucti fðsþ ¼E4F L ½Z1SŠ. E:Z$:4½:Z=ZŠF L S4LjS4E:4½:Z=ZŠF ¼ LyW L ½Z1SŠ ¼ LyW S4LS4LyE4F L ½Z1E:ZF L ½Z1SŠ Š ¼ LyW S4L S4LyE4F L ½Z1LySŠ Fr ay st f squcs S 4 L, lt S c ¼ L\S. By D Mrga laws, fr ay tw sts A ad B: (A X B) c ¼ A c W B c,(a W B) c ¼ A c X B c, A 4 B 0 B c 4 A c. cg c E:Z$:4½:Z=ZŠF L WfLyS ¼ c 4LjS4 E4F L ½Z1S c Š c ¼ WfLyS c 4LjE4F L ½Z1S c Š 4Sc g c ¼ X LyS c 4LjE4F L½Z1S cš 4Sc ¼ X S c 4LjE4F L½Z1S cš4sc Mrvr, w ivstigat th smatics f th xprssi Cr 1 I r 2 D4 as dfid abv: ECr 1 Ir 2 D4F L ¼ E:½r 1Ir 2 Š:4F L L0 ¼ s Lj:cq$matchðs; r 1 ; qþ0s0 LyE4F L0 ¼ s Lj:cq$matchðs; r 1 ; qþ0:s0 E4F ¼ s Lj:cq$: matchðs; r 1 ; qþ^s 0 E4F L0 ;q ¼ s Ljdq 0 $ matchðs; r 1 ; qþ^s 0 E4F L0 ;q I th drivati abv w usd th squt j 0 :4 w :(j ^ 4), which ca b asily prvd by prpsitial calculus. W als usd th fact that fr ay st f squcs S, S X (L\S ) ¼ Ø. It is wrth tig hr that th smatics f Cr 1 I r 2 D4 is csistt with th dfiiti f th mdality CD frm mdal m-calculus Tablau-basd prf systm Bfr w prst th ruls f th tablau, w dfi th immdiat subfrmula rlati (Clavlad, 1990) 3 I as: 43 I :4 43 I ½r 1 Ir 2 Š4 4 i 3 I 4 1^4 2 i f1; 2g 43 I Z$4 W dfi 3 t b th trasitiv clsur f 3 I ad 6 t b its trasitiv ad rflxiv clsur. A tablau-basd prf systm starts frm th frmula t b prvd as th rt f a prf tr ad prcds i a tp dw fashi. I vry rul f th tablau, th cclusi is abv th prmiss. Each cclusi f a crtai rul rprsts a d i th prf tr, whras th prmiss rprst th childr t this d. I ur cas, th prf systm prvs squts f th frm H, bw s 4, which mas that udr a st H f hypthss ad th symbl b, th th squc s satisfis th prprty 4. Th st H ctais lmts f th frm s: Z$4 ad is dd fr rcursiv frmulas. Rughly, th us f H is t say that i rdr t prv that a squc s satisfis a rcursiv frmula 4 rc, w must prv th fllwig: Udr th hypthsis that s satisfis 4 rc, th s als satisfis th ufldig f 4 rc. W als dfi th st H l Z$4 ¼ {s Ljs:Z$4 H}. Th us f H, ad b will b appart aftr w stat th ruls f th prf systm: H; bws :4 R : H; :bws 4 R^ R R ½Š R CCDD H; b; ws 4 1^4 2 H; b 1 ws 4 1 H; b 2 ws 4 2 b 1 b 2 ¼ b H; bws Z$4 H 0 Wfs : Z$4g; bws 4½Z$4=ZŠ H; bws ½r 1 Ir 2 Š4 x 1 x 2 /x H; bws CCLDD4 H; bws^l 4 whr H 0 ¼ Hyfs 0 : GjZ$43Gg x i ¼ H; b i wr 2 q i 4 cditi 8 < cq i $matchðs; r 1 ; q i Þ cditi ¼ ^ b 1 b 2 / b ¼ b : ^ > 0 s : Z$4;=H Th first rul ccrs gati f frmulas whr b {, :} srvs as a mmry t rmmbr gatis, i this cas 4 ¼ 4. W dfi ¼, :¼: ¼:, ad :: ¼. Mrvr, w dfi ¼, :¼: ¼:, ad ::¼:. Th scd rul says that i rdr t prv th cjucti, w hav t prv bth cjucts. Th third rul ccrs prvig a rcursiv frmulas, whr th cstructi f th st H, via H 0, surs that th validity f th squt H, bw s Z$4 is dtrmid ly by subfrmulas f 4 (Clavlad, 1990). Th

6 digital ivstigati 4S (2007) S82 S91 S87 furth rul taks car f frmulas matchig squcs t pattrs. Fially, th fifth rul dals with frmulas dalig with subtrs f th mdl tr L. Startig frm th frmula t b prvd at th rt f th prf tr, th tr grws dwwards util w hit a d whr th tr cat b xtdd aymr, i.., a laf d. A frmula is prvd if it has a succssful tablau, whr a succssful tablau is whs all lavs ar succssful. A succssful laf mts f th fllwig cditis: H, w s Z ad s EZF L. H, : w s Z ad s;ezf L. H, w s Z.4 ad s:z.4 H. H, w s [r 1 I r 2 ]4 ad {s Ljdq$match(s, r 1, q)} ¼ Ø. I th xt scti, w list th mst imprtat prprtis f th tablau-basd prf systm Prprtis f tablau systm W wuld lik t prv thr mai prprtis, amly th fiitss f th tablau fr fiit mdls, th sudss, ad th cmpltss. Sudss ad cmpltss ar prvd with rspct t a rlativizd smatics that taks it accut th st H f hypthss. Th w smatics is th sam as th prvidd abv fr all frmulas xcpt fr rcursiv frmulas whr is it dfid as: EZ$4F L;H ¼ E4F L;H ½Z1SWS 0 Š WS 0 whr S 0 ¼ HlZ$4 I th quati, th gratst fixpit pratr is applid t a fucti fðsþ ¼E4F L;q ½Z1SŠ whs argumt is S W S 0. Sic th fucti is mt vr a cmplt lattic, as mtid arlir, th th xistc f a gratst fixpit is guaratd. W w list sm rsults rgardig th prf systm. Th dtaild prfs ar t prvidd du t spac limitati. Thrm 3.1. Fiitss. Fr ay squt H, bw s 4 thr xists a fiit umbr f fiit tablaux.th ida f th prf is that fr ay frmula at th rt f th prf tr w bgi applyig th ruls R :, R^, R [], R CCDD, ad R. Th applicati f th first fur ruls rsults i shrtr frmulas, whil th applicati f th R rul rsults i largr hypthsis sts H. Th prf shws that shrtig a frmula ad icrasig th siz f H cat ctiu ifiitly. Hc path i th tr will hav ifiit lgth. Brachig happs i th prf tr whvr w hav a xprssi f th frm 4 1 ^ 4 2 r [r 1 I r 2 ]4. Fiit brachig is guaratd i th first cas by th fiit lgth f ay xprssi ad i th scd cas by th fiitss f th mdl. Thrm 3.2. Sudss. Fr ay squt H, bws 4 with a succssful tablau, s E4F L;H Th ida bhid th prf is t shw that all th succssful lavs dscribd abv ar valid ad that th applicati f th ruls f th tablau rsrvs smatic validity. Thrm 3.3. Cmpltss. If fr a squc s L, s E4F L;H, th th squt H, bw s 4 has a succssful tablau.th prf rlis shwig that w cat hav tw succssful tablaux fr th squts H, bw s 4 ad H, bw s :4. 4. Exampl f lgs ad prprtis I this scti w giv a xampl f cstructig a mdl f actual lg systms ad xprssig sm gral prprtis. Th mthdlgy w apply hr ca b asily adaptd t varius systms f lgs. W bgi by listig th sigatur f ur algbra ad th tati usd fr cstats ad variabls. Th srts f th sigatur ar giv i Tabl 1, whras th pratis ar giv i Sctis 4.1 ad 4.2. Ths pratis ar catgrizd basd th ctxt t which thy ar rlatd. I mst cass, th tati w us fr th ams f pratis ad srts rvals thir itdd maig ad i cas f ambiguity w will prvid xplaati. S, i rdr t mdl a sigl lg, a parsr ca b dvlpd that will pars th lg ad cstruct its mdl as a squc f algbraic trms, whr ach trm crrspds t a crtai lg vt. Th mdl fr a systm f svral lgs will b a tr whs labls ar trms as xplaid i Scti 2. Oc th mdl is cstructd, th dsird prprtis ca b xprssd as frmulas f th lgic w prstd. Th mdl ad lgic ca th b submittd t a mdl chckr that will chck if th mdl satisfis th frmula. Th prsc f a tablau-basd prf systm fr th lgic srvs as a startig pit fr th implmtati f a mdl chckig algrithm. Such a framwrk ca b usd i vt rcstructi basd xprssig scaris ad hypthss as prprtis, ad th vrify thir validity, this will b xplaid i Tabl 1. Tabl 1 Srts f th algbra Srts Cstats Variabls Fil f 1, f 2,., f f x, f y, f z,. Usr u 1, u 2,., u u x, u y, u z,. Objct 1, 2,., x, y, z,. bjctdid ID 1, ID 2,., ID ID x, ID y, ID z,. Prcss p 1, p 2,., p p x, p y, p z,. Srvic s 1, s 2,., s s x, s y, s z,. srvic_typ st 1, st 2,., st st x, st y, st z,. rgistry_ky r 1, r 2,., r r x, r y, r z,. Oprati p READ, p WRITE p x, p y, p z,. Excutabl 1, 2,., x, y, z,. Privilg pv ADMIN pv x, pv y, pv z,. Accss ac N Allwd ; ac ALLOWED ac x, ac y, ac z,. Prt pt PORT NO pt x, pt y, pt z,. Prtcl prc UDP, prc TCP,., u prc x, prc y, prc z,. ipaddrss ip 1, ip2,., ip ip x, ip y, ip z,. dattim dt 1,dt 2,., dt dt x,dt y,dt z,. lgtyp lt INTERACTIVE, lt REMOTE,. lt x, lt y, lt z,. lgid lid 1, lid 2,., lid 3 lid x, lid y, lid z,. Siz/typ s_t POD. s_t x, s_t y, s_t z,. args a 1, a 2,., a a x, a y, a z,. rrr r 1, r 2,., r r x, r y, r z,. bl Tr, Fl b x, b y, b Z,.

7 S88 digital ivstigati 4S (2007) S82 S Machi vts lgs I this scti, w discuss lgs f vts rlatd t a sigl machi. This machi culd b a stad al systm r a d i a twrk, hwvr, th vts w csidr hr ar itral vts rlatd t a spcific machi. It is t ur itti t giv a xhaustiv list f all pssibl vts but t dmstrat th us f ur mdl usig varius catgris f vts. Each typ f lg vts is mdld by a prati f th algbra as will b dmstratd blw Prcss rlatd actis Ths ar th vts rlatd t th crati ad dstructi f a prcss. PrcssBgi : prcss usr callr privilg xcutabl/bl PrcssExit : prcss usr/bl Fr istac, th trm PrcssExit( p x, u x ) mdls a actual lg vt i which ay usr (u x ) trmiatd ay prcss ( p x ), sic u x ad p x ar variabls. O th thr had, th trm PrcssExit ( p x, u 1 ) mdls a actual lg vt i which a crtai usr (u 1 ) trmiatd ay prcss ( p x ). Tabl 1 prsts ur tati fr variabls ad cstats Objct rlatd actis I a Widws systm, a bjct is ithr a fil r a rgistry ky. Th vts which ar rlatd t bjcts ar pig, mdifyig ad clsig th bjcts. Ths vts ar mdld as actis as fllws: ObjctOp : bjct prcss prcssnam typ lgid/bl ObjctCls : bjct/bl ObjctOprati : bjct prati/bl Usr actis Ths ar actis rlatd t crati, dlti, r mdificatis t usr accuts ad thir rights as wll as lgs ad lgffs. Lg : usr usrid grup dmai prcss lgtyp/bl Lgff : usram/bl Miscllaus Evts that ar t spcific t ay catgry ar mtid hr. SchdulTask : usr prcss callr fil dattim/bl IstallSrvic : srvic fil srvic typ usram/bl UistallSrvic : srvic usr dattim/bl DactAtiVirus : usr dattim/bl DactFirwall : usr dattim/bl OpCcti : prcss prt prtcl usr accss dattim/bl ClarLgs : usr dattim/bl 4.2. Ntwrk vts lgs I this scti w csidr lgs that mitr twrk vts, i.., rlatd t mr tha machi Itrusi dtcti systm Hr w us SNORT (Srt, 2007) as a xampl fr ur mdlig. Th SID shw blw is th attack ID usd by SNORT t dtct a kw sigatur. Attack : dattim SID surcip dstip/bl Wb srvr GtErrr : dattim rrr ipaddrss/bl PstErrr : dattim rrr/bl Gt : dattim args ipaddrss/bl Pst : dattim args ipaddrss/bl UUCP : dattim ipaddrss/bl Hr args is th srt f argumts fr th Pst ad Gt actis Prprtis ad scaris A imprtat us f th lgic is th ability t xprss a attack r a crtai scari f vts usig a pattr basd th gral charactrizatis f this attack r scari. I thr wrds, a ivstigatr ca xprss th attack r th vts h is lkig fr as a pattr i a lgic frmula usig th sytax f th lgic dscribd abv. Th, usig a mdl chckr, h ca sarch th lg mdl fr such a attack r scari f vts i rdr t rcstruct th squc f vts that lad t th icidc udr ivstigati. T furthr illustrat hw this ca b usd, w hav dfid a gral attack scari which is dividd it fur phass. Udr ach phas w hav grupd th pssibl vts that a ivstigatr wuld wat t sarch fr. Th gral attack scari is as fllws: Itrusi/Cmprmis/Misus/Withdrawal whr ach f Itrusi, Cmprmis, Misus ad Withdrawal is a crtai squc f vts. Th Itrusi squc csists f th vts that ar capturd durig th tim th attackr brachd th systm usig diffrt tchiqus such as buffr vrflw, malicius cds, tc. Evts i this catgry ca b xtractd frm th lgs f a itrusi dtcti systm. Sm pattrs ca b rcgizd as sigs f itrusis such as wh a srvic xcutig with admiistrativ privilgs starts a cmmad shll ca allud t a buffr vrflw attack. This pattr is dmstratd blw, whr w us as a shrthad fr rplacig sigl trms with ; ad lavig squc variabls x i as thy ar, t b csistt with sytax ruls, als w us h fr sytactic quality: Cx 1 $PrcssBgi p x ; u x ; p y ; pv ADMIN ; x $x 2 $PrcssBgi p z ; u y ; p x ; pv z ; 1 IDtt; whr 1 hcmd$x I th xprssi abv th prcss p x startd with admiistrativ privilgs ad th it calld p z which is th cmmad shll. Th Cmprmis squc csists f vts prtaiig t th prparati fr malicius activity. Durig this phas th attackr is sttig up what is dd t carry ut th itdd attack. I additi, th attackr tris t prvid himslf with cvit sttigs t rtur t th systm at will. Ths

8 digital ivstigati 4S (2007) S82 S91 S89 iclud but ar t limitd t: Cratig a usr, chagig grup r passwrd, istallig r uistallig a srvic, dactivatig ativirus ad firwall sftwar, chagig imprtat fils r rgistris, tc. Ths vts ca b cstructd i diffrt squcs, squc ca b: Cx 1 $DactFirwallðu x ; dt x Þ$x 2 $DactAitvirus u x ; dt y $x3 IDtt I th xprssi abv th sam usr (u x ) dactivatd th firwall fllwd by a dactivati f th ativirus, which is suspicius. Of curs, it is pssibl t labrat mr cmplx pattr but w ar just usig xprssis fr dmstrativ purpss. Th Misus squc rprsts th phas durig which th attackr uss th cmprmisd systm fr his w malicius purpss. Th vts csidrd fr this phas ar: lcal r rmt lgi usig th cratd accuts i th prvius phass, pig a ccti t th systm, tc. As a xampl, csidr th fllwig prprty f a lg squc: Cx 1 $OpCcti p x ; pt x ; prc x ; u x ; ac N ALLOWED ; dt x $x2 IDtt I th xprssi abv, a usr trid t p a ccti that was rfusd, mayb bcaus th usr ds t hav th rquird privilg. A rpatd pattr lik this idicats suspicius bhavir f this particular usr. Th Withdrawal squc rprsts th phas durig which th attackr tris t cvr his tracks claig th systm frm his malicius activitis. Th vts may b: dltig fils, uistallig a srvic, clarig th lg fils, tc. A xampl fr hw a withdrawal may b xprssd: Cx 1 $UistallSrvicðs x ; u x ; dt x Þ$x 2 $ClarLgs u x ; dt y $x3 IDtt S far w hav shw hw a attack scari ca b xprssd usig ur prpsd apprach. T furthr labrat th usfulss f this apprach w dmstrat tw typs f prprtis: (A) Suspicius facts ad ivariat prprtis f a systm Suspicius facts ar vts that, wh triggrd, may b idicatis f a attack; such as, a trustd xcutabl big xcutd by a utrustd bjct. Ivariat prprtis ar cditis that shuld b always satisfid. Fr xampl, fr vry lg thr shuld b a lgff: 5. Cas study T bttr cmprhd th pwr f ur apprach, w will csidr th fllwig cas: i a ffic virmt usig Widws-basd machis, thr ar svral hsts cctd t a databas srvr. A itrusi dtcti systm is stup as a scurity masur fr th srvr. Th srvr ca b accssd frm utsid th cmpay s that th mplys ca cct t th srvr frm clit ffics. Fig. 1 dpicts th scari. Th twrk admiistratr discvrs that thr was a dial f srvic attack th srvr. Th itrusi dtcti systm (IDS) SNORT dtrmis a SYN attack which causd th srvr t halt. A ivstigatr is calld up t ivstigat this icidt. Th ivstigatr gathrs th srvr twrk lgs ad starts sarchig fr pssibl clus. Grally, wh aalyzig lgs, a ivstigatr will ithr sca thrugh th lgs maually usig a simpl ditr which may prvid sm filtrig capabilitis, r crat a script t srv his purps. Usig ur mthdlgy, th ivstigatr ly dfis a pattr fr a trac h wats t lk fr, ad sic all lgs ar cmbid i a sigl mdl, h ds t d t csidr lgs sparatly. Mrvr, if th ivstigatr wishs t fcus a sigl lg r a umbr f lgs, h ca us th CCDD pratr i th lgic t d th jb. I ur particular cas, lt us supps th systm admiistratr has rprtd a SYN attack which is dtctd by SNORT ad lggd with SID ¼ 1:526 (1). T lcat th ccurrc f this attack th admiistratr uss th fllwig trac frm th SNORT lgs: CCSNORTDDCx 1 $Attackðdt x ; sid 1 ; sip x ; dip x Þ$x2IDtt; whr sid 1 ¼ 1 : 526 Oc th ivstigatr fids th vt that lggd th attack, h xamis it ad ralizs that this IP is withi th sam twrk f th cmpay. Kwig th dat ad tim f th first ccurrc f th attack, th ivstigatr lks fr cctis pd th sam dat ad tim frm that hst t th srvr. Util w, th vts hav b mstly gathrd frm th IDS lgs. Th advatag ad practicality f ur mdl X$Cx 1 $lg u x ; uid x ; g x ; d x ; p x ; lt x $x2 IDttCx 1 $lgff ðuid x Þ$x 2 IDtt0Cx 1 $lg u x ; uid x ; g x ; d x ; p x ; lt x $x2 $lgff ðu x Þ$x 3 Ix 1 $x 2 $x 3 DX (B) Hypthsis prprtis Durig th ivstigati, th ivstigatr shuld b abl t vrify th admissability f a claim, a hypthsis r a spculati by xprssig it i th frm f a prprty ad submittig th lgic xprssi t a mdl chckr. A xampl is th assumpti that a fil, wh xcutd, will dactivat th firwall ad istall a srvic which will b usd as a backdr: Cx 1 $PrcssBgiðp x ; u x ; p y ; pv x ; x Þ$x 2 $DactFirwall ðu x ; dt x Þ$x 3 $IstallSrvic s x ; f x ; st x ; u x ; dt y $x4 IDtt Fig. 1 Cas scari.

9 S90 digital ivstigati 4S (2007) S82 S91 which crrlats all lgs it a tr ar shw hr sic th Widws systm, applicati, ad scurity lgs ar crrlatd alg with th twrk lgs. Th lgs big crrlatd it th sam tr, w ca dfi th pattrs f tracs that w ar lkig fr usig a lgic frmula ad th mdl chckr will sarch fr thm thrugh th tr. Hwvr, t imprv fficicy, w ca spcify which lg w wat t xami thus rducig th scp f ur sarch. This ca b d by addig ILgSurcJ right bfr th crrspdig pattr r trac. LgSurc i this cas big SNORT (lik i th pattr abv), SEC (scurity lg), SYS (systm lg), r APP (applicati lg). It is pssibl t spcify mr th lg,.g., ISYS, SECJ, r all lgs xcludig spcific lg,.g., CCLySNORTDD. Gttig back t ur cas, th vt rflctig pig a ccti ca b fud usig: rgistry ky (bjctoprati( 1, p SET )) ad th usram f th attackr, which may tur ut t b diffrt frm th usr mal mtid arlir. Such a situati is dpictd by th fllwig tracs whr, i trms, ly th rlvat argumts ar listd: CCSEC; SYS; APPDD Cx 1 $OpCcti p x ; pt x ; prc TCP ; uid x ; ip 1 ac x ; dt 1 $x2 IDtt whr ip 1 is th srvr s IP addrss ad dt 1 is th tim, ths tw valus ca b btaid frm SNORT lgs as xplaid abv. Lkig at th prcss that pd th ccti (th variabl p x ), th ivstigatr fids ut that p x is a crtai prcss p 1. Th ivstigatr w wats t kw ifrmati abut th lauchig f this prcss: CCSECDD Cx 1 $PrcssBgi p 1 ; u x ; cp x ; pv x ; x $x2 IDtt Assum th callr f p 1, i.., cp x, is p 2. Usig th sam frmula as th abv but rplacig p 1 with p 2 i th trm PrcssBgi(.), th ivstigatr ca fid ut th am ad xcutabl fil f p 2. It turs ut t b b2k.x, which is th xcutabl fil f backorific2000; a backdr. Th xt stp is t track dw sssis i which th back dr has b xcutd which ca b dtrmid by th fllwig: CCSECDD Cx 1 $Lg u x ; uid x ; g x ; d x ; p x ; lt x $x2 $PrcssBgi p x ; u x ; cp x ; pv x $ 1 $x3 $Lgff u x ID:Cx4 $PrcssBgi ðp y ; u x ; cp x ; pv x $ 1 Þ$x 5 $;$x 6 IDtt whr 1 hb2k$x Th frmula abv lks fr all sssis (a sssi is budd by a lg ad a lgff) i which th malicius xcutabl 1 is lauchd. Supps i all f ths sssis, at ach lg f a crtai usr mal t th systm, th back dr prgram is xcutd, th ivstigatr suspcts that thr is a try i f th start-up rgistry kys fr B2k.x. Th fllwig frmula lks fr th first sssi durig which th ru rgistry ky has b mdifid bfr th first xcuti f th back dr prgram. CCSECDDCx 1 $Lg u x ; uid x ; g x ; d x ; p x ; lt x $x2 $ PrcssBgi p x ; u x ; cp x ; pv x $ 1 $x3 $Lgffðu x ÞID ð:cx 4 $PrcssBgiðp y ; u x ; cp x ; pv x $ 1 Þ$x 5 $;$x 6 IDtt ^Cx 6 $lgðu y ; uid y ; g y ; d y ; p y ; lt y Þ$x 7 $bjctop 1 ; p z ; p z ; tp z ; lid z $x8 $bjctoprati 1 ; p SET $x9 $lgff ðu y Þ$x 10 $;$x 11 I > ttþ whr 1 hrun REG Frm this frmula, th ivstigatr will b abl t kw th sssi durig which th malicius attackr has chagd th Th figur abv shws tw tracs, whr w assumd th vt a appard ccurrtly with attack, hc th xistc f tw brachs. Th ida w wuld lik t xprss hr is that althugh th SYN attack may b cmig frm th machi f th usr u usr, a carful frsic aalysis usig ur lgic rvals that th rgistry ky was mdifid by th usr u TchSupprt, which is th ral rspsibl. 6. Cclusi ad futur rsarch I this papr w prpsd a mdl chckig apprach t th prblm f frmal aalysis f lgs. W mdl th lg as a tr labld by trms frm a trm algbra that rprsts th diffrt actis lggd by th lggig systm. Th prprtis f such a lg ar xprssd thrugh th us f a lgic that has tmpral, mdal, dyamic ad cmputatial charactristics. Mrvr, th lgic is prvidd by a sud ad cmplt tablau-basd prf systm that ca b th basis fr vrificati algrithms. A xampl was giv i which w prstd idas abut prprtis f lgs such as attack tracs ad ivariat prprtis. W als dmstratd hw ur systm ca b usd t rcstruct th squc f vts ladig t SYN attack. A futur rsarch dircti may b th dvlpmt f a fficit mdl chckig algrithm basd ur prf systm.

10 digital ivstigati 4S (2007) S82 S91 S91 rfrcs Adi K, Dbbabi M, Mjri M. A w lgic fr lctric cmmrc prtcls. It J Thr Cmput Sci, TCS 2003; 291(3): Clavlad R. Tablau-basd mdl chckig i th prpsitial Mu-calculus. Acta Ifrm 1990;27(8): Cupps F. Maagig alrts i a multi-itrusi dtcti virmt. I: Prcdigs f th 17th aual cmputr scurity applicatis cfrc, Dcmbr Cupps F, Mig A. Alrt crrlati i a cprativ itrusi dtcti framwrk. I: Prcdigs f th 2002 IEEE sympsium scurity ad privacy, May Dbar H, Wspi A. Aggrgati ad crrlati f itrusidtcti alrts. I: Rct advacs i itrusi dtcti. LNCS 2212; Gladyshv P, Patl A. Fiit stat machi apprach t digital vt rcstructi. Digit Ivstig J 2004;1(2). Gladyshv P, Patl A. Frmalisig vt tim budig i digital ivstigatis. Digit Ivstig J 2005;4(2). Hsmr C. Tim liig cmputr vidc. Availabl frm: < [Visitd May 22, 2007]. Julisch K. Clustrig itrusi dtcti alarms t supprt rt caus aalysis. ACM Tras Ifrm Syst Scur Nv 2003;6(4): Krus W, Hisr J. Cmputr frsics: icidt rsps sstials. Bst, MA: Addis-Wsly; 2002 [Visitd May 22, 2007]. Liglad R, Krigs AW. A frmalizati f digital frsics. Digit Ivstig J 2004;3(2). Mr K, Baily D. Systm bas-liig: a frsic prspctiv. Availabl frm: < basliig.pdf>; 2003 [Visitd May 22, 2007]. Mri B, Dbar H. Crrlati f itrusi symptms: a applicati f chricls. I Prcdigs f th sixth itratial cfrc rct advacs i itrusi dtcti (RAID 03), Sptmbr Mri B, M L, Dbar H, Ducass M. M2D2: a frmal data mdl fr IDS alrt crrlati. I: Prcdigs f th fifth itratial sympsium rct advacs i itrusi dtcti (RAID 2002), Nig P, Cui Y, Rvs DS. Cstructig attack scaris thrugh crrlati f itrusi alrts. I: Prcdigs f th ith ACM cfrc cmputr ad cmmuicatis scurity, Washigt, DC, Nvmbr p Pikari C, Chuvaki A. Scurity warrir. O Rilly; Prras P, Fg M, Valds A. A missi-impact-basd apprach t INFOSEC alarm crrlati. I: Prcdigs f th fifth itratial sympsium rct advacs i itrusi dtcti (RAID 2002); Stallard T, Lvitt K. Autmatd aalysis fr digital frsic scic: smatic itgrity chckig. I: 19th aual cmputr scurity applicatis cfrc, Las Vgas, NV, USA, Dcmbr Staifrd S, Haglad J, McAlry J. Practical autmatd dtcti f stalthy prtscas. J Cmput Scur Dcmbr 2002;10(1/2): Stphs P. Mdlig f pst-icidt rt caus aalysis. It J Digit Evid 2003;2(2). Srt surcfir Ic., < [Visitd May 22, 2007]. Tabl Ntwrk Scurity, < [Visitd May 22, 2007]. Tmplt S, Lvitt K. A rquirs/prvids mdl fr cmputr attacks. I: Prcdigs f w scurity paradigms wrkshp, Sptmbr Valds A, Skir K. Prbabilistic alrt crrlati. I: Prcdigs f th furth itratial sympsium rct advacs i itrusi dtcti (RAID 2001); Wchlr W. Uivrsal algbra fr cmputr scitists. Sprigr; Xu D. Alrt crrlati thrugh triggrig vts ad cmm rsurcs, < [Visitd May 22, 2007]. Ygswara V, Barfrd P, Jha S. Glbal itrusi dtcti i th dmi vrlay systm. I: Prcdigs f th 11th aual twrk ad distributd systm scurity sympsium (NDSS 04), Fburary Ali Rza Arasth is a mastr studt i th Dpartmt f Cmputr Scic at Ccrdia Uivrsity. H hlds B.Sc. dgr frm Amirkabir Uivrsity, Thra, Ira. His mai rsarch itrsts ar frsics mmry aalysis, lg aalysis ad itrusi dtcti systms. Murad Dbbabi is a Full Prfssr ad th Assciat Dirctr f th Ccrdia Istitut fr Ifrmati Systms Egirig at Ccrdia Uivrsity. H is als a Ccrdia Rsarch Chair Tir I i Ifrmati Systms Scurity. H hlds Ph.D. ad M.Sc. dgrs i cmputr scic frm Paris-XI Orsay, Uivrsity, Frac. H publishd svral rsarch paprs i itratial jurals ad cfrcs cmputr scurity, cybr frsics, frmal smatics, mbil ad mbddd platfrms, Java tchlgy scurity ad acclrati, cryptgraphic prtcl spcificati, dsig ad aalysis, malicius cd dtcti, prgrammig laguags, typ thry ad spcificati ad vrificati f safty-critical systms. I th past, h srvd as Sir Scitist at th Paasic Ifrmati ad Ntwrk Tchlgis Labratry, Prict, Nw Jrsy, USA; Assciat Prfssr at th Cmputr Scic Dpartmt f Laval Uivrsity, Qubc, Caada; Sir Scitist at Gral Elctric Crprat Rsarch Ctr, Nw Yrk, USA; Rsarch Assciat at th Cmputr Scic Dpartmt f Stafrd Uivrsity, Califria, USA; ad Prmat Rsarchr at th Bull Crprat Rsarch Ctr, Paris, Frac. Assaad Sakha is a M.Sc. studt at Ccrdia Istitut f Ifrmati Systm Egirig, Ccrdia Uivrsity wrkig i th fild f Digital Frsics. Th mai ara f his rsarch is frsic lg aalysis. H btaid his B.Sc. i Cmputr Ifrmati Systms at Ntr Dam Uivrsity, Lba. I additi h is a mmbr f th Ifrmati Systm Audit ad Ctrl Assciati (ISACA). Mhamd Salh is a Ph.D. studt at Ccrdia Uivrsity wrkig i IT scurity. His mai rsarch itrst is i th us f frmal mthds i th spcificati ad vrificati f scurity prtcls. H has als cductd sm rsarch wrk i applicati scurity, amly usig Java.