Method for systematic collection and analysis of forensic data in a unified communications system deployed in a cloud environment

A method for systematic collection and analysis of data in a unified communications system deployed in a cloud environment, comprising the steps of:

• integrating at least one evidence collection mechanism with the unified communications system, wherein said at least one evidence collection mechanism is operative to capture forensic data related to operation of the unified communications system and at least one component in the cloud environment;
• generating at least one model which captures the normal behavior of the unified communications system;
• monitoring, by at least one intrusion detection system, the unified communications system for an occurrence of an unauthorized action using captured said forensic data and the at least one model;
• upon the occurrence of an unauthorized action, transmitting, by said at least one intrusion detection system, an alarm to a forensic controller, wherein said forensic controller is operatively connected to but physically and logically separate from the cloud environment;
• upon the transmission of the alarm to said forensic controller, collecting, by said at least one evidence collection mechanism, said forensic data;
• building, by said forensic controller, at least one footprint data structure from the collected forensic data;
• formatting said at least one footprint data structure, wherein the step of formatting enables said at least one footprint data structure to be used by at least one forensics software application tool;
• generating at least one self-forensic investigator for use to detect any malicious behavior in the unified communications system, wherein said at least one self-forensic investigator is generated using said at least one footprint data structure;
• and
• alerting, by said at least one self-forensic investigator, said forensic controller upon the detection of any malicious behavior in the unified communications system.

A method for systematic collection and analysis of data in a unified communications system deployed in a cloud environment, comprising the steps of:

• integrating at least one evidence collection mechanism with the unified communications system, wherein said at least one evidence collection mechanism is attached to at least one component in the cloud environment and operative to capture forensic data related to operation of the unified communications system and the at least one component the cloud environment;
• generating at least one model which captures the normal behavior of the unified communications system;
• monitoring, by at least one intrusion detection system, the unified communications system for an occurrence of an unauthorized action using captured said forensic data and the at least one model;
• upon the occurrence of an unauthorized action, transmitting, by said at least one intrusion detection system, an alarm to a forensic controller, wherein said forensic controller is operatively connected to but physically and logically separate from the at least one component in the cloud environment;
• upon the transmission of the alarm to said forensic controller, collecting, by said at least one evidence collection mechanism, said forensic data;
• storing, by said forensic controller, collected forensic data in an evidence database that is operatively connected to but physically and logically separate from the at least one component in the cloud environment;
• building, by said forensic controller, at least one footprint data structure from the collected forensic data;
• and
• formatting said at least one footprint data structure, wherein the step of formatting enables said at least one footprint data structure to be used by at least one forensics software application tool;
• generating at least one self-forensic investigator for use to detect any malicious behavior in the unified communications system, wherein said at least one self-forensic investigator is generated using said at least one footprint data structure;
• and
• alerting, by said at least one self-forensic investigator, said forensic controller upon the detection of any malicious behavior in the unified communications system.