Forensix: Large-scale Tamper-resistant Computer Forensic Systems

计算机取证系统是与在线入侵和异常检测相辅相成的大规模审计系统，一直是网络安全领域研究较少的领域。入侵和异常检测系统试图对事件进行主动的在线分析，而取证系统则试图记录正在处理的所有信息，以供后续的离线分析。在很大程度上，计算机取证仍然是一种特别的活动，应用于已经受到威胁的系统。利用计算、网络和存储系统的进步，并建立在入侵检测系统社区内的工作基础上，该项目将建立一个实验性的计算机取证系统，使系统管理员、执法官员和安全专家能够在安全事件发生后快速、轻松地追踪到来源。所提出的方法有许多独特的方面，包括：(I)在攻击发生之前，在操作系统内核级主动跟踪被监视的系统的变化，以捕获取证数据(Ii)将审计信息支持到本地连接的日志记录主机。此日志记录主机仅导出一项服务：来自受监视主机的审计跟踪信息。仅允许通过控制台对日志记录主机进行所有其他访问。因此，日志主机是一个将提供极其详细的系统信息的系统。(Iii)保存日志信息的数据库系统。其中调查了用于填充数据库以允许对记录信息进行高级查询的技术。这项研究的主要问题是：(I)能否构建可扩展的主动日志记录主机来捕获大量攻击？(Ii)数据库技术能否用于主动挖掘恶意活动？(Iii)如何开发文件系统和数据库技术以支持可扩展日志记录？

Computer forensic systems are large-scale auditing systems that are complementary with on-line intrusion and anomaly detection and have been a relatively understudied field in network security. Whereas intrusion and anomaly detection systems attempt to do an active on-line analysis of events, forensic systems seek to log all of the information being processed for subsequent, off-line analysis. For the most part, computer forensics is still an ad-hoc activity that is applied to a system that has already been compromised.Leveraging the advances in computing, networking, and storage systems and building on the work within the IDS community, the project will build an experimental computer forensics system that will allow system administrators, law enforcement officials, and security experts to quickly and easily track down sources of security incidents after they have happened. There are a number of unique aspects of proposed approach including:(i) Actively tracking changes to the system being monitored at the operating system kernel level before an attack occurs to capture forensic data(ii) Backing the audit information to a locally connected logging host. This logging host exports only one service: the audit trail information from the host being monitored. All other access to the logging host is allowed only through the console. Thus, the logging host is a system that will provide extremely detailed system information.(iii) A database system to hold logging information. With an investigation of techniques for populating a database to allow advanced queries on the logging information. The goal of this is to allow complex queries to be performed while monitoring the system.The main questions to answer as a result of this research are:(i) Can a scalable proactive logging hosts be built to capture a large number of attacks?(ii) Can database technologies be used to actively mine fore malicious activities?(iii) How can file systems and database technologies be developed to support scalable logging?