MeviDoS: uma metodologia para análise forense em redes de computadores com foco em ataques de negação de serviço

• Ano de defesa: 2020
• Autor(a) principal: CANTANHEDE, Hans Newton Fonseca
• Orientador(a): VALE, Samyr Béliche
• Banca de defesa: VALE, Samyr Béliche , SILVA, Francisco José da Silva e , RÊGO, Paulo Antonio Leal
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Federal do Maranhão
• Programa de Pós-Graduação: PROGRAMA DE PÓS-GRADUAÇÃO EM CIÊNCIA DA COMPUTAÇÃO/CCET
• Departamento: DEPARTAMENTO DE INFORMÁTICA/CCET
• País: Brasil
• Palavras-chave em Português: Análise forense em redes de computadores; Metodologia; Ataque de negação de serviço; Lei de crimes informáticos 12.737 de 2012 no Brasil; Arquitetura computacional; Investigação forense digital
• Palavras-chave em Inglês: Computer network forensic analysis; Methodology; Denial of service; Brazil’s computer crime law 12,737 of 2012; Computer architecture; Digital forensic investigation
• Área do conhecimento CNPq: Ciência da Computação
• Link de acesso: https://tedebc.ufma.br/jspui/handle/tede/3153

The problem addressed in this work is the difficulty in holding agents responsible for making denial of service attacks in Brazil’s network infrastructures and systems. With the advent of Law 12,737 of 2012 in Brazil, known as the Computer Crimes Law, these attacks are considered crimes. It is therefore necessary to identify the elements that characterize the malicious activity as criminal and that there are procedures that assist in this clarification for the accountability of criminal offenders in computerized media. However, no procedure was found to support the operators of the law in applying the Computer Crimes Law to the specific case. This paper proposes, therefore, the MeviDoS methodology enlightened by Computer Crimes Law of 2012 for forensic analysis of computer networks, with a focus on highlighting the elements of accountability for offending agents who commit denial of service attacks, in addition to presenting a computational architecture to automate its steps. To this end, a review of related works and sections dedicated to clarifying the terms and technologies necessary to contextualize the research were promoted. This work also presents the methodology constituted of its stages, the architecture to accomplish those stages and the results of the experiments carried out to validate the methodology. It is concluded that the access to the necessary information to formalize the accountability of the offending agent, such as: the origin, the destination, the technique used, the time and place of the crime can be discovered using the proposed MeviDoS methodology. Thus demonstrating that the investigating authority can proceed with the duly substantiated accountability of the offending agents who commit denial of service attacks.