Automated recognition of event scenarios for digital forensics

ABSTRACT

The authors have previously developed the ECF (Event Correlation for Forensics) framework for scenario matching in the forensic investigation of activity manifested in digital transactional logs. ECF incorporated a suite of log parsers to reduce event records from heterogeneous logs to a canonical form for lodging in an SQL database. This paper presents work since then, the Auto-ECF system, which represents significant advances on ECF. The paper reports on the development and implementation of the new event abstraction and scenario specification methodology and on the development of the Auto-ECF system which builds on that to achieve the automated recognition of event scenarios. The paper also reports on the evaluation of Auto-ECF using three scenarios including one from the well known DARPA test data.

REFERENCES

• 1: Chen Kevin, Andrew Clark, Olivier De Vel and George Mohay "ECF - Event Correlation for Forensics" In Proceedings of 1st Australian Computer, Network & Information Forensics Conference Perth, Western Australia, 2003.
• 2: NetForensics, "NetForensics," http://www.netforensics.com/, 2003.
• 3: GuardedNet, "GuardedNet neuSECURE," http://www.guarded.net/, 2003.
• 4: e-Security Inc., "e-Security Management System," http://www.esecurityinc.com/, 2003.
• 5: GFI Software USA, "LANguard Security Event Log Monitor," http://www.gfisoftware.de/, 2003.
• 6: Sawmill, "Flowerfire," www.sawmill.net, 2003.
• 7: TNT Software, "ELM Log Manager," https://www.tnttechnology.com/, 2003.
• 8: I3P - Institute for Information Infrastructure Protection, "National Information Infrastructure Protection Research and Development Agenda Initiative Report, Information Infrastructure Protection: Survey of Products, Tools and Services," http://www.thei3p.org, 9 Sept 2002.
• 9: Joshua Haines , Dorene Kewley Ryder , Laura Tinnel , Stephen Taylor, Validation of Sensor Alert Correlators, IEEE Security and Privacy, v.1 n.1, p.46-56, January 2003 [doi>10.1109/MSECP.2003.1176995]
• 10: Bishop M. "A Standard Audit Trail Format" In Proceedings of 18th National Information Systems Security Conference, 1995. pp. 136--145.
• 11: CERIAS, "Audit Trails Format Group," http://www.cerias.purdue.edu/about/history/coast/projects/audit-trails-format.php: Purdue University, 2003.
• 12: CERIAS Audit Trail Reduction Group, http://www.cerias.purdue.edu/about/history/coast/projects/audit-trails-reduce.php: Purdue University, 2003.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Management, Security

Keywords:
computer forensics, event correlation, events, heterogeneous event logs, logs