Forensics in Telecommunications, Information, and Multimedia. Third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, Revised Selected Papers

Research Article

Enhance Information Flow Tracking with Function Recognition

Download
456 downloads
  • @INPROCEEDINGS{10.1007/978-3-642-23602-0_16,
        author={Kan Zhou and Shiqiu Huang and Zhengwei Qi and Jian Gu and Beijun Shen},
        title={Enhance Information Flow Tracking with Function Recognition},
        proceedings={Forensics in Telecommunications, Information, and Multimedia. Third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, Revised Selected Papers},
        proceedings_a={E-FORENSICS},
        year={2012},
        month={10},
        keywords={function recognition information flow tracking},
        doi={10.1007/978-3-642-23602-0_16}
    }
    
  • Kan Zhou
    Shiqiu Huang
    Zhengwei Qi
    Jian Gu
    Beijun Shen
    Year: 2012
    Enhance Information Flow Tracking with Function Recognition
    E-FORENSICS
    Springer
    DOI: 10.1007/978-3-642-23602-0_16
Kan Zhou1,*, Shiqiu Huang1,*, Zhengwei Qi1,*, Jian Gu2,*, Beijun Shen1,*
  • 1: Shanghai JiaoTong University
  • 2: Ministry of Public Security
*Contact email: zhoukan@sjtu.edu.cn, hsqfire@sjtu.edu.cn, qizhwei@sjtu.edu.cn, gujian@mail.mctc.gov.cn, bjshen@sjtu.edu.cn

Abstract

With the spread use of the computers, a new crime space and method are presented for criminals. Computer evidence plays a key part in criminal cases. Traditional computer evidence searches require that the computer specialists know what is stored in the given computer. Binary-based information flow tracking which concerns on the changes of control flow is an effective way to analyze the behavior of a program. The existing systems ignore the modifications of the data flow, which may be also a malicious behavior. Function recognition is introduced to improve the information flow tracking, which recognizes the function body from the software binary. And no false positive and false negative in our experiment strongly prove that our approach is effective.