오픈스택 플랫폼에서 클라우드 포렌식에 관한 연구

Abstract

Cloud forensics is difficult to collect evidence because the definition of evidence data in cloud environment is not clear and it needs more cooperation from CSPs. Also, it may cause a loss of evidence because the evidence data is physically distributed and the cloud computing resources may be present in virtual space. In this thesis, therefore, we propose a cloud platform-based forensic procedures for cloud forensics and classify the log data by cloud layer according to the proposed procedure. By building a cloud environment using the OpenStack, we describe limitations of the actually collected evidence and propose methods to address the challenges of cloud forensics. It ensures improved integrity and reliability of evidence. To deal with these limitations, we make a snapshot of the instance and analyze details of a snapshot. In addition, the collection and storage of evidence data in the cloud are performed by the processes as intactly as possible that are defined in the OpenStack.