線上社群網路應用之追蹤鑑識

Abstract

近年來通訊方式的重大變化，大部份的使用者，轉移到以雲端技術為基礎的應用(Cloud-based Applications)，特別是在線社群網路(On-line Social Networks, OSNs)。這些應用服務大多託管在國外，罪犯者可以應用他們來躲避刑事調查和情報蒐集。在這虛擬世界中，執法機構(Law Enforcement Agency, LEA)如何辨別出(Identify) 社群網路中犯罪嫌疑犯的「真實」身分，及其所在的「實體」位置(Geolocation)，是目前數位調查(Digital Investigation)上所面臨的重大挑戰。 鑑此，本文研提一個方案，應用IP定位(IP Location)和網路鑑識 (Network Forensics)的概念，目的在發展一個在線社群網路的追蹤鑑識方法與架構。根據我們的實證分析顯示，當目標(Target)用戶使用社群網路應用服務時(例如：Facebook、Twitter等)，透過所研提的機制與方法即可根據該應用的服務資源標識符(Service Resource Identifier, SRI)，亦即帳號，追蹤到目標用戶的「實體位置(Physical Location)」、歷史軌跡，並可以關聯分析出可能的「身分」，可以用來橋接(Bridge)實體世界與虛擬世界。據我們所知，這是第一個針對OSNs所發展和評估的個化分析和定位之方法和架構。

In recent years, with significant changes in the communication modes, most users are diverted to cloud-based applications, especially On line Social Networks (OSNs), which applications are mostly hosted on the outside and available to criminals, enabling them to impede criminal investigations and intelligence gathering. In the virtual world, how the Law Enforcement Agency (LEA) identifies the 'actual' identity of criminal suspects, and their Geolocation in social networks, is a major challenge to current digital investigation. In view of this, this paper proposes a scheme, based on the concepts of IP location and Network Forensics, which aims to develop forensics tracking on Online Social Networks. According to our empirical analysis, the proposed mechanism can instantly trace the “physical location” of a targeted service resource identifier (SRI), when the target client is using online Social Network applications (Facebook, Twitter, etc.), and can analyze the probable target client “identity” associatively. To the best of our knowledge, this is the first individualized location method and architecture developed and evaluated in OSNs.