EAGER: Privacy-Preserving Approaches to Proactive Forensics

EAGER：主动取证的隐私保护方法

• 批准号: 1442069
• 负责人: Brian Levine
• 金额: $ 9.99万
• 依托单位: University of Massachusetts Amherst
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-06-01 至 2016-05-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1442069&HistoricalAwards=false
• 关键词: EAGER; Privacy; Preserving; Approaches; Proactive

Insider attacks are a critical issue for companies and governments in scenarios involving trade secrets, sensitive information, intellectual property, personally identifiable information, classified documents, and more. Too many existing approaches for responding to these attacks rely on mechanisms that assume the recovery of locally stored, unencrypted data. These techniques fail on the growing number of devices that employ file system encryption and cloud storage. This project advances novel methods of offering to an attacker's system covert evidence of their attack that may remain after primary data and documents are encrypted or securely wiped. The data has precise meaning to investigators that is demonstrable in court and to other third parties. The data is obfuscated from interpretation by third parties without investigator assistance, and thus is privacy preserving. The long-range outcome of this project will be the enabling of research including:  generalized methods of attack response when the computers involved are outside or partially outside the administrator's control, automated methods of discovering channels for offering evidence, and defenses against these techniques. Our research is an important stepping stone towards the broader topic of privacy-preserving, proactive investigation of attacks committed using networked computer systems.

在涉及商业秘密、敏感信息、知识产权、个人身份信息、机密文件等的情况下，内部攻击是公司和政府面临的一个关键问题。响应这些攻击的太多现有方法依赖于假设恢复本地存储的未加密数据的机制。这些技术在越来越多的采用文件系统加密和云存储的设备上失败。该项目提出了向攻击者的系统提供其攻击的隐蔽证据的新方法，这些证据可能在主要数据和文档被加密或安全擦除后仍然存在。这些数据对调查人员有确切的意义，可以在法庭上和其他第三方证明。数据在没有调查人员协助的情况下被第三方混淆解释，因此是隐私保护。该项目的长期成果将是使研究，包括：一般化的攻击响应方法时，所涉及的计算机是外部或部分管理员的控制，发现渠道提供证据的自动化方法，以及对这些技术的防御。我们的研究是一个重要的垫脚石对隐私保护，主动调查使用网络计算机系统进行攻击的更广泛的主题。