A framework for cloud forensics evidence collection and analysis using security information and event management

Abstract

A primary feature of cloud computing is the provision of a variety of transparent services with efficient resource utilization. However, there are concerns with cloud computing in terms of the user's data privacy and security, especially in evidence collection for forensics analysis, because the tangible resources and hardware are out of reach for users who own the data. This paper presents a framework using security information and event management SIEM, to address the issue of efficient evidence collection for crime investigation, such as that for cloud forensics, with respect to the cloud service provider. Indeed, evidence could be shared with cloud users when required. SIEM can be considered as a major player in terms of evidence collection in a virtualized environment. The proposed mechanism using SIEM focuses on passive attacks and provides a solution from the cloud administrator or service provider's point of view. The proposed framework can help in performing detailed cloud forensics in terms of efficient evidence building for crime investigations. Copyright © 2016 John Wiley & Sons, Ltd.