MsFaaS: Microservices Forensics as a Service

Abstract The rapid increase in using cloud services leads to the rise of unlimited cyber threats. Due to the distributed architect nature, services like Software as a Service (SaaS) are hard to be monitored. Consequently, in digital crimes, the investigator faces several forensics challenges. Mainly, in collecting data and presenting acceptable electronic evidence at the court. While most researchers went towards the external investigator’s responsibility, fewer researchers went to the Cloud Service Provider’s (CSP) responsibility. In literature, no complete framework that resolves all challenges and succeeds in presenting trusted evidence to the court has been suggested. In the present paper, we propose a framework named Microservices Forensics as a Service (MsFaaS) that suggests solutions to resolve open challenges. Since the CSP holds the crime scene and there is a global legal responsibility against digital crimes, MsFaaS relies on enforcing international law and putting the responsibility on both CSP and local authorities where the victim/attacker and CSP operate. We collect several data types and use event reconstruction methodology to build a comprehensive crime scene in both live and postmortem scenarios. In addition, MsFaaS provides a validation service against man-in-the-middle attacks microservices. It also triggers a response action to virtual machines incidents and external attacks; finally, the framework is helpful for auditing and recording the external and internal traffic inside the cloud environment. As a result, the service provided by the framework offers an evidence report that is certified by the local authority which can be accepted in a digital crime trial.