BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem

Kenny Awuson - David, Tawfik Al-Hadhrami, Mamoun Alazab Alazab, Nazaraf Shah, Andrii Shalaginov

    Research output: Contribution to journalArticlepeer-review

    6 Citations (Scopus)
    9 Downloads (Pure)

    Abstract

    Log files are the primary source of recording users, applications and protocols, activities in the cloud ecosystem. Cloud forensic investigators can use log evidence to ascertain when, why and how a cyber adversary or an insider compromised a system by establishing the crime scene and reconstructing how the incident occurred. However, digital evidence acquisition in a cloud ecosystem is complicated and proven difficult, even with modern forensic acquisition toolkit. The multi-tenancy, Geo-location and Service-Level Agreement have added another layer of complexity in acquiring digital log evidence from a cloud ecosystem. In order to mitigate these complexities of evidence acquisition in the cloud ecosystem, we need a framework that can forensically maintain the trustworthiness and integrity of log evidence. In this paper, we design and implement a Blockchain Cloud Forensic Logging (BCFL) framework, using a Design Science Research Methodological (DSRM) approach. BCFL operates primarily in four stages: (1) Process transaction logs using Blockchain distributed ledger technology (DLT). (2) Use a Blockchain smart contract to maintain the integrity of logs and establish a clear chain of custody. (3) Validate all transaction logs. (4) Maintain transaction log immutability. BCFL will also enhance and strengthen compliance with the European Union (EU) General Data Protection Regulation (GDPR). The results from our single case study will demonstrate that BCFL will mitigate the challenges and complexities faced by digital forensics investigators in acquiring admissible digital evidence from the cloud ecosystem. Furthermore, an instantaneous performance monitoring of the proposed Blockchain cloud forensic logging framework was evaluated. BCFL will ensure trustworthiness, integrity, authenticity and non-repudiation of the log evidence in the cloud.
    Original languageEnglish
    Pages (from-to)1-13
    Number of pages13
    JournalFuture Generation Computer Systems
    Volume122
    Early online date2 Apr 2021
    DOIs
    Publication statusPublished - Sep 2021

    Bibliographical note

    NOTICE: this is the author’s version of a work that was accepted for publication in Future Generation Computer Systems. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Future Generation Computer Systems, 122, (2021) DOI: 10.1016/j.future.2021.03.001

    © 2021, Elsevier. Licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International http://creativecommons.org/licenses/by-nc-nd/4.0/

    Keywords

    • Blockchain
    • DSRM
    • GDPR
    • Digital log evidence
    • Trustworthiness
    • Admissibility

    ASJC Scopus subject areas

    • Software
    • Hardware and Architecture
    • Computer Networks and Communications

    Fingerprint

    Dive into the research topics of 'BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem'. Together they form a unique fingerprint.

    Cite this