Research on Forensic Methods of the Process Behavior Based on CSP
Danwei Chen · Journal of Nanjing University of Posts and Telecommunications · 2009
For the abnormal process behaviors got in digital forensic process,the paper gives a method of reconstructing the crime process with the process events.In the method,it firstly formally describes dangerous process operations and process communications by CSP theory,and builds a communication state model of process using the process records in system to get the process communication rules,then finds the communication sequence which can form reasonable evidence link after analyzing all possible communication sequences in the model with interpretation algorithm based on path search and excluding communication sequences out of rules.In the last,the paper gives a specific analysis and explanation of process behaviors by formalizing evidences and constructing CSP model,and validates the feasibility and effectiveness of the method with the developed simulation software.