I-Corps: Tools for Database Forensic Analysis and Intrusion Detection

这个I-Corps项目的更广泛的影响/商业潜力是解决和减轻普遍存在的数据泄露问题。它将为法医分析人员提供调查数据库管理系统的工具，目前在大多数调查中，数据库管理系统是一个黑匣子。为此，它将把以前开发的法证分析方法与方便用户的解释和报告结合起来。对于现有的数据监控安全解决方案，该项目将消除网络安全工具中仍然存在的安全漏洞。当前的安全解决方案只能对记录的活动做出反应，留下各种黑客攻击（例如，滥用超级权限或黑客攻击）来绕过日志记录。该项目的成果将检测和报告绕过现有安全机制的恶意数据访问行为。该I-Corps项目将开发新的方法，将数据库中的数字文物呈现给法医和安全分析师。该项目不仅仅是呈现单个的取证工件，还将致力于创建支持用户搜索的证据报告，并提供足以作为证据的监管链保证。通过跟踪数据库内部发生的数据流，该项目将在数据库内恶意数据访问或篡改的情况下提供解释和可靠的证据。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact/commercial potential of this I-Corps project is to address and mitigate the ongoing problem of pervasive data breaches. It will provide forensic analysts with tools for investigating database management systems (DBMS), currently a black box in most investigations. It will do so by combining previously developed forensic analysis approaches with user-friendly interpretation and reports. For existing data monitoring security solutions, this project will eliminate the security gaps that remain exploitable in cybersecurity tools. Current security solutions can only react to the logged activity, leaving a variety of hacks (e.g., abusing super-privileges or hacking) to bypass the log records. The outcome of this project will detect and report malicious data access stemming from actions that bypassed existing security mechanisms.This I-Corps project will develop new approaches for presenting digital artifacts from a database to forensic and security analysts. Rather than merely present the individual forensic artifacts, this project will target creation of evidential reports supporting user search and providing chain-of-custody guarantees sufficient as evidence. By tracing the data flow occurring inside the database, this project will enable interpretation and sound evidence in cases of malicious data access or tampering within a database.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.