Towards Digital Forensics Investigation of WordPress Applications Running Over Kubernetes

Abstract

Forensics investigation of WordPress applications hosted on containerized cloud environment is critically important due to their increased adaptation and an exponential increase in cybercrimes. Investigation of containerized environments is complex due to their volatile nature and dynamic allocation. This paper explores the forensic analysis of WordPress applications deployed inside a containerized environment. In this paper, we have used a log analysis approach to perform the digital forensics investigation of different attacks on WordPress applications running over Kubernetes. To investigate these events, we collected a large number of operational logs generated by these applications. Log filtrations techniques are applied to analyze only the relevant logs for a specific event to perform the forensic investigation efficiently. The experimental results confirm the proposed approach's effectiveness as we could trace all the malicious events to conduct the digital investigation on the WordPress applications running inside Kubernetes. The scheme successfully identified the attacker's information like incident time, incident source, duration of attack etc. Moreover, the proposed solution also provided forensics readiness for the WordPress applications running in a container-based cloud.