SaTC: EDU: A Formal Approach to Digital Forensics and Incident Response Investigations

该项目的目标是为数字取证和事件响应(DFIR)教育开发一个平台。该平台将基于现有的名为Nugget的概念验证原型构建。由此产生的平台将与工具无关，并将支持不同的教学方法。该平台将能够以一种易于理解的方式对不同的、可能很大的数据源制定和应用取证查询。该项目将使网络安全和执法分析员等领域专家能够学习和进行法医调查。将利用该平台开发一套实践材料，以支持数字取证和事件应对的两个课程序列。该平台将为所有DFIR分析技术提供一个正式和统一的概念框架，并将使不同的DFIR教育方法成为可能。这将允许从入门课程到以研究为中心的研究生课程使用相同的概念框架，并使教师能够更清楚地专注于概念，而不是具体的工具。关联的运行时环境将允许将查询的规范与其实现分离。该项目将产生一个工具，提供将高级取证能力逐步整合到网络安全课程中的手段，如SaaS取证、数据分析，并最终将更深层次的人工智能技术纳入网络安全课程。该平台将提供从云驱动器和在线协作等流行的云服务获取和分析数据的手段，还将与安全监控/事件响应系统集成。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The goal of this project is to develop a platform for digital forensics and incident response (DFIR) education. The platform will be built based on an existing proof-of-concept prototype called Nugget. The resulting platform will be tool-agnostic and will support different pedagogical approaches. The platform will provide the ability to formulate and apply forensic queries over different, and potentially large, data sources in an easy to understand manner. The project will make it possible for domain experts, such as cybersecurity and law enforcement analysts, to learn and perform forensic investigations. A set of hands-on materials, that utilize the platform, will be developed to support a two-course sequence in digital forensics and incident response. The platform will provide a formal and unifying conceptual framework for all DFIR analytical techniques, and will enable different approaches to DFIR education. This will allow courses from introductory to research-centric graduate courses, to use the same conceptual framework, and will enable instructors to focus more clearly on concepts rather than specific tools. The associated runtime environment will allow the separation of the specification of a query from its implementation. This project will result in a tool that provides the means to incrementally integrate advanced forensic capabilities, such as SaaS forensics, data analytics, and eventually deeper AI techniques into cybersecurity curricula. The platform will provide the means to acquire and analyze data from popular cloud services, such as cloud drives and online collaboration, and will also integrate with security monitoring/incident response systems.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.