Multi-agent Based Forensic Analysis Framework for Infrastructures Involving Storage Networks

In this paper, we present a framework based on collaborative multi-agent approach for performing real-time forensic analysis on those infrastructures which involve storage networks such as storage area network, storage servers or network attached storage. For this activity is logged surrounding the file accesses made on the servers, storage devices and other components by deploying independent agents at different components, including storage networks and servers. The agents keep on collecting event logs and collaborate with each other to identify malicious accesses and generate alerts accordingly. The framework offers a consolidated view of the sequence of different activities happened on storage network infrastructure and allied servers at any point in time.