MeviDoS: uma metodologia para análise forense em redes de computadores com foco em ataques de negação de serviço

Abstract

The problem addressed in this work is the difficulty in holding agents responsible for making denial of service attacks in Brazil’s network infrastructures and systems. With the advent of Law 12,737 of 2012 in Brazil, known as the Computer Crimes Law, these attacks are considered crimes. It is therefore necessary to identify the elements that characterize the malicious activity as criminal and that there are procedures that assist in this clarification for the accountability of criminal offenders in computerized media. However, no procedure was found to support the operators of the law in applying the Computer Crimes Law to the specific case. This paper proposes, therefore, the MeviDoS methodology enlightened by Computer Crimes Law of 2012 for forensic analysis of computer networks, with a focus on highlighting the elements of accountability for offending agents who commit denial of service attacks, in addition to presenting a computational architecture to automate its steps. To this end, a review of related works and sections dedicated to clarifying the terms and technologies necessary to contextualize the research were promoted. This work also presents the methodology constituted of its stages, the architecture to accomplish those stages and the results of the experiments carried out to validate the methodology. It is concluded that the access to the necessary information to formalize the accountability of the offending agent, such as: the origin, the destination, the technique used, the time and place of the crime can be discovered using the proposed MeviDoS methodology. Thus demonstrating that the investigating authority can proceed with the duly substantiated accountability of the offending agents who commit denial of service attacks.