Intrusion Investigations with Data-Hiding for Computer Log-File Forensics

In most of companies or organizations, logs play important role in information security. However, the common security mechanism only backup logs, it is not able to find out traces of intruders because the hacker who is able to intrudes the security mechanism of organization would try to alter logs or destroy important intrusion evidences making it impossible to preserve evidence using traditional log security strategies. Thus, logs are not considered as evidence to prove the damage. In that case, digital evidence lacks in terms of completeness which makes it difficult to perform computer forensics operations. In order to maintain the completeness and reliability of evidence for later forensic procedures and intrusion detection, the study applies concepts of steganography to logs forensics, for which even intrusion altered records will be kept as well. Comparing to traditional security strategies, this study proposes a better logging mechanism to ensure the completeness of logs. Furthermore, the study will assist in intrusion detection through alteration behavior, and help in forensic operations.