NexGenDFA: A Framework for Next Generation Digital Forensic Analysis

随着网络攻击的数量和规模的激增，数字取证(DF)已经成为安全专家不可或缺的工具。网络攻击正在给企业造成数万亿美元的损失，数十亿个人和财务记录的损失(以及可能干预选举)。在安全事件发生后执行数字取证，对于确定攻击的根本原因和可能的个人是必要的。它还有助于避免未来发生类似事件，并在可能的情况下，加快任何受影响的服务的恢复。然而，由于许多原因，数字取证正成为一项非常复杂和势不可挡的任务，其中包括：(1)大量具有取证兴趣的数据源，有时是专有格式的数据源；(2)大量的取证数据；以及(3)网络攻击中新技术的关联(区块链、物联网(IoT)、互联和自主车辆、无人机以及云/边缘/雾计算)。所有这些都增加了数字证据获取、分类和分析的过程。在这个研究计划中，我建议调查取证框架和相关工具的设计和实现，这些工具使用机器学习算法和大数据视觉分析相结合，超出了取证工具的当前技术水平。该项目的结果将为数字法医分析师提供更好地揭示、理解和证据片段的知识和工具，从而帮助削减数字法医调查的时间和成本。此外，该计划还将解决导致巨大社会效益和经济效益的真实世界数据分析问题。最后但并非最不重要的一点是，该计划还将有助于培养研究人才，并在机器学习和视觉分析方面培训HQP，使加拿大在这些领域处于领先地位。

With the spike in the number and scale of cyberattacks, digital forensic (DF) has become an indispensable tool for security experts. Cyberattacks are costing businesses trillions of dollars, and the loss of billions of personal and financial records (and possible meddling with elections). Executing digital forensics after a security incident becomes a necessity to identify root causes and possibly individuals behind the attack. It can also help to avoid future similar incidents, and when possible, accelerate the restoration of any service affected. However, digital forensics is becoming a very complex and overwhelming task due to a number of reasons including; (1) the large number of data sources of forensic interest and sometimes in proprietary formats, (2) the enormous volume of forensic data, and last but not least, (3) the association of new technologies in cyberattacks (Blockchain, Internet of Things (IoT), Connected and Autonomous Vehicles, Drones, and cloud/edge/fog computing). These all add convolution to the processes of digital evidence acquisition, triage and analysis. In this research program, I propose to investigate the design and implementation of a forensic framework and associated tools that use machine learning algorithms combined with big data visual analytics that go beyond the current state of the art of forensic tools. The outcome of the program will help cut the time and cost for digital forensic investigations, by providing digital forensic analyst with the knowledge and tools to better unveil, understand and evidence pieces. Additionally, the program will address real-world data analytic problem leading to enormous social and economic benefits. Last but not least, the program will also contribute to the development of research talents and the training of HQP in machine learning and visual analytics, positioning Canada as a leader in these fields.