Complexity Analysis of Retrieving Knowledge from Auditing Log Files for Computer and Network Forensics and Accountability

Behaviors of users in a computer or a computer network can be observed by system authorities via logs of all the actions. In a computer or network system, if at some point the fact that the content of a secret file is leaking has been already known, to figure out the reasons of the leaking, we can search partial or entire log files to find out direct or indirect accesses to the file; since a user who accessed the secret before may send messages containing the secret to other users (the secret is leaking due to indirect accesses) via packets in a computer network, or via pipe/FIFO/message-queue/etc. in a computer system, finding the reasons of the leaking is not a trivial task. In this paper, we analyze and simulate the complexity of retrieving knowledge from the computer and network auditing log database for forensics and accountability.