EAGER: Privacy-Preserving Approaches to Proactive Forensics

在涉及商业秘密、敏感信息、知识产权、个人身份信息、机密文件等情况下，内部攻击对公司和政府来说是一个关键问题。太多现有的应对这些攻击的方法依赖于假定能够恢复本地存储的未加密数据的机制。这些技术在越来越多采用文件系统加密和云存储的设备上失效。该项目提出了一种新颖的方法，向攻击者的系统提供他们攻击的隐蔽证据，这些证据可能在主要数据和文件被加密或安全清除后仍然存在。这些数据对调查人员有明确的意义，可以在法庭和其他第三方证明。在没有调查人员协助的情况下，数据被第三方解释混淆，因此是隐私保护。该项目的长期成果将是使研究成为可能，包括：当涉及的计算机不在或部分不在管理员控制范围内时，攻击响应的通用方法，发现提供证据的渠道的自动化方法，以及对这些技术的防御。我们的研究是迈向更广泛的隐私保护主题的重要垫脚石，对使用网络计算机系统的攻击进行主动调查。

Insider attacks are a critical issue for companies and governments in scenarios involving trade secrets, sensitive information, intellectual property, personally identifiable information, classified documents, and more. Too many existing approaches for responding to these attacks rely on mechanisms that assume the recovery of locally stored, unencrypted data. These techniques fail on the growing number of devices that employ file system encryption and cloud storage. This project advances novel methods of offering to an attacker's system covert evidence of their attack that may remain after primary data and documents are encrypted or securely wiped. The data has precise meaning to investigators that is demonstrable in court and to other third parties. The data is obfuscated from interpretation by third parties without investigator assistance, and thus is privacy preserving. The long-range outcome of this project will be the enabling of research including:  generalized methods of attack response when the computers involved are outside or partially outside the administrator's control, automated methods of discovering channels for offering evidence, and defenses against these techniques. Our research is an important stepping stone towards the broader topic of privacy-preserving, proactive investigation of attacks committed using networked computer systems.