WebCapsule: Towards a Lightweight Forensic Engine for Web Browsers

Performing detailed forensic analysis of real-world web security incidents targeting users, such as social engineering and phishing attacks, is a notoriously challenging and time-consuming task. To reconstruct web-based attacks, forensic analysts typically rely on browser cache files and system logs. However, cache files and logs provide only sparse information often lacking adequate detail to reconstruct a precise view of the incident. To address this problem, we need an always-on and lightweight (i.e., low overhead) forensic data collection system that can be easily integrated with a variety of popular browsers, and that allows for recording enough detailed information to enable a full reconstruction of web security incidents, including phishing attacks. To this end, we propose WebCapsule, a novel record and replay forensic engine for web browsers. WebCapsule functions as an always-on system that aims to record all non-deterministic inputs to the core web rendering engine embedded...

• Type: Journal
• Year: 2015
• Where: CCS
• Authors: Christopher Neasbitt, Bo Li, Roberto Perdisci, Long Lu, Kapil Singh, Kang Li
• Keywords: CCS 2015, Security Privacy