A game-theoretic defensive approach for forensic investigators against rootkits

Abstract

Forensic science aims to present evidence in the courtroom, in a forensically sound manner. Therefore, forensic procedures must guarantee the provability, admissibility, accuracy, and authenticity of the case's evidence. However, anti-forensics threaten forensic procedures by forging, hiding, and even modifying remaining evidence in a crime scene. For instance, rootkits hide traces of attacks in a compromised system. To prevent anti-forensics, forensic investigators use de-anti-forensic methods (e.g. anti-rootkits).The necessity of more research on anti-forensics motivated us to propose a game-theoretic approach to model the interactions between an attacker and an investigator (players) who use rootkits and anti-rootkits, respectively. We assume these players act competitively, and each does not know his/her opponent's pay-off. We identify sets of characteristics for rootkits and anti-rootkits to profile them and define each player's actions. We examine the existence of the Nash Equilibrium for a two-player game. Experimental results show the simulated game is convergent. Thus, we identify the investigators' most desirable and stable defensive strategies against the attacker's most desirable and stable offensive strategies. We also formulate a relationship between characteristics of rootkits and anti-rootkits using the Nash Equilibrium of the game. Finally, we propose some general features to help investigators to evaluate anti-rootkits and design more efficient defensive tools.