Using Infrastructure-Based Agents to Enhance Forensic Logging of Third-Party Applications

Jennifer Bellizzi, Mark Vella, Christian Colombo, Julio Hernandez-Castro

2023

Abstract

Logs are the primary data source forensic analysts use to diagnose and investigate attacks on deployed applications. Since the default logs may not include all application events required during an investigation, application-specific forensic logging agents are used to forensically enhance third-party applications post-deployment and ensure that any critical events are logged. However, developing such application-specific agents is impractical as this relies on application-specific knowledge requiring significant code comprehension efforts. Furthermore, the resulting forensic logging agents are likely to break compatibility between application versions and across applications; thus, requiring the time-consuming process of agent re-development much more frequently. We propose a more practical approach to developing forensic logging agents that leverages commonly-used underlying infrastructure, which is more stable across application versions and common across different applications. We evaluate our approach in the context of enhanced logging of Android messaging apps. Our results show that this approach can be used to develop logging agents that work across multiple apps while preserving the accuracy of the logs generated, thus mitigating the challenges associated with forensically enhancing third-party applications.

Paper Citation

in Harvard Style

Bellizzi J., Vella M., Colombo C. and Hernandez-Castro J. (2023). Using Infrastructure-Based Agents to Enhance Forensic Logging of Third-Party Applications. In Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-624-8, pages 389-401. DOI: 10.5220/0011634700003405

in Bibtex Style

@conference{icissp23,
author={Jennifer Bellizzi and Mark Vella and Christian Colombo and Julio Hernandez-Castro},
title={Using Infrastructure-Based Agents to Enhance Forensic Logging of Third-Party Applications},
booktitle={Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2023},
pages={389-401},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011634700003405},
isbn={978-989-758-624-8},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 9th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Using Infrastructure-Based Agents to Enhance Forensic Logging of Third-Party Applications
SN - 978-989-758-624-8
AU - Bellizzi J.
AU - Vella M.
AU - Colombo C.
AU - Hernandez-Castro J.
PY - 2023
SP - 389
EP - 401
DO - 10.5220/0011634700003405