Visibility: a novel concept for characterising provable network digital evidences

Abstract

Providing a formal method of digital investigation happened to be of utmost importance, as it allows to: demonstrate the absence of design weaknesses in the used technique; analyse the security incident with an accurate manner; provide non refutable proofs regarding the obtained results. We provide in this work a new formal concept, entitled Visibility, and we develop its relation with network digital investigation, particularly the investigation of source address spoofing attacks. To demonstrate the effectiveness of our visibility-based theory, we use it in conjunction with an efficient traceback technique to prove IP spoofing attacks occurrence and identify their source.