Evidence Building for Ad Click or Web Access on Cloud

Abstract

Web related illegal activities are increasing beyond expectation in recent years. Association of National Advertisers has reported that businesses lost more than $6.5 billion in 2017 due to fraudulent activities of ad frauds. Website of Github was down on 28 February, 2018 due to Distributed Denial of Services (DDoS) attack. The attack of DDoS was conducted through memcached servers. Analysis on relevant log data (web access log or ad click log) is required to identify such illegal incidents in digital forensics investigation. An evidence building methodology is proposed and implemented to generate required log data. The proof of concept is provided by coding three scripts, two in python and one in JavaScript. Virtual Machine (VM) on Amazon Web Service (AWS) has been utilized to execute one python script for log separation. Second python script is executed on client database server to store fingerprint of each click or web access. Fingerprint is a generated hash value unique for each device accessing a website or clicking an advertisement (ad). The third JavaScript code is to be embedded in client web page(s) or ad. The verification of log data has also been discussed with the help of fingerprints. The verification process allows regenerating the fingerprints of log data stored in AWS data store. The regenerated fingerprints are being matched with fingerprints stored in client’s database server. The proposed methodology can identify malicious intention of the cloud service provider (CSP) or the investigator or attacker. The proposed methodology can be extended to cloud forensics.