FOREST: Inspecting and tracking RESTful APIs for constructing a cloud forensic knowledge base

초록

Modern cloud-based services increasingly rely on RESTful APIs to manage user data. However, many of these APIs are undocumented and frequently change without notice, posing challenges to digital forensic investigations. First, undocumented APIs may expose forensic-relevant data while bypassing standard access logging. Second, frequent structural changes hinder reproducible and verifiable evidence acquisition. To address these challenges, we present FOREST, a framework for the automated discovery, analysis, and tracking of RESTful API behavior in real-world cloud environments. FOREST analyzes live API traffic generated through natural user interactions, identifies undocumented endpoints, extracts artifact-bearing responses, and generates OpenAPI Specifications. It also supports longitudinal schema comparison and parameter dependency analysis to ensure consistent data acquisition across service versions. We evaluate FOREST on Microsoft OneDrive, Microsoft Teams, and Mattermost. The results demonstrate its effectiveness in uncovering undocumented APIs, tracing structural API changes, and supporting reliable forensic analysis in dynamic cloud service environments.

키워드