Digital forensics
New digital forensic techniques and systems are disclosed. System call information is collected from a device under test (DUT) and converted to a sequence format. Thereafter, sequence alignment methods and tools can be used to investigate and identify patterns of behavior that are suspicious.
1. A digital forensic analysis method performed in a processor, the method comprising the steps of:
collecting historical system call data from a digital computing system (DCS), the historical system call data corresponding to a plurality of system calls which comprise system calls corresponding to suspicious activity performed on the DCS;
converting the collected historical system call data to form a historical sequence comprising a string of sequence elements in which each system call is represented as solely one sequence element;
selecting from a system call sequence database a test sequence comprising a string of sequence elements in which each sequence element represents a system call, wherein the system calls represented in the test sequence correspond to the suspicious activity performed on the DCS, the system calls which correspond to the suspicious activity being represented by suspicious activity sequence elements that are non-contiguous in at least one of the historical sequence and the test sequence; and
applying, via a computing, processor, a non-contiguous sequence alignment algorithm to the historical sequence and the test sequence during a post-event sequence matching process, the non-contiguous sequence alignment algorithm being operative to match the suspicious activity sequence elements of the historical sequence with the suspicious activity sequence elements of the test sequence to thereby detect suspicious activity reflected in the historical system call data collected from the DCS, wherein the non-contiguous sequence alignment algorithm is operative to identify a longest sequence of suspicious activity sequence elements common to the historical sequence and the test sequence, and wherein applying a non-contiguous sequence alignment algorithm comprises use of a biological sequence matching algorithm.
2. The method of claim 1 , wherein the sequence elements are alphanumeric characters of the Roman alphabet.
3. The method of claim 1 , wherein said biological sequence matching algorithm uses Karlin-Altschul statistics as a basis for determining sequence alignment.
4. The method of claim 1 , further comprising performing a frequency domain analysis of the historical system call data.
5. The method of claim 4 , wherein the frequency domain analysis comprises assigning a value as an amplitude to each system call.
6. The method of claim 4 , wherein the frequency domain analysis comprises constructing a signal on a basis of a number of occurrences of individual alphabets per unit time in the test sequence.
7. The method of claim 1 , wherein an entry in the system call sequence database is constructed by:
running a test scenario on the DCS and collecting system call data generated by the test scenario;
converting said system call data to a test sequence in which one system call is represented as solely one sequence element; and
recording a sequence of systems calls as a database entry corresponding to the test scenario.
8. The method of claim 1 , wherein said system call sequence database is unique to a given DCS.
9. The method of claim 1 , wherein said historical system call data is collected at an interface between kernel and user space of the DCS.
10. The method of claim 9 , wherein said historical system call data is collected by a software wrapper that intercepts all system calls made between the kernel and the user space.
11. The method of claim 1 , further comprising the step of emulating a user interface and using the test sequence of system calls to recreate graphically user actions on an emulated graphical user interface.
12. The method of claim 11 , wherein said emulation step comprises:
reading ahead of a displayed time slice and compiling the data; and
subsequently displaying the simulated user experience in an order as input by a user of the DCS.
13. The method of claim 1 , wherein at least one of the steps carried out following collection of data from a device under test (DUT) are carried out at a location remote from at least one of the DUT and a DUT host organization.
14. The method according to claim 1 , wherein identifying the longest sequence of suspicious activity sequence elements common to the historical sequence and the test sequence comprises:
determining an extent of similarity between the suspicious activity sequence elements comprised in the historical sequence and the suspicious activity sequence elements comprised in the test sequence, wherein at least one gap between suspicious activity sequence elements comprised in at least one of the historical sequence and the test sequence is weighted less heavily than the suspicious activity sequence elements during the determination of extent of similarity.
15. A computer-program product comprising a non-transitory computer-readable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a digital forensic analysis method comprising:
collecting historical system call data from a digital computing system (DCS), the historical system call data corresponding to a plurality of system calls which comprise system calls corresponding to suspicious activity performed on the DCS;
converting the collected historical system call data to form a historical sequence comprising a string of sequence elements in which each system call is represented as solely one sequence element;
selecting from a system call sequence database a test sequence comprising a string of sequence elements in which each sequence element represents a system call, wherein the system calls represented in the test sequence correspond to the suspicious activity performed on the DCS, the system calls which correspond to the suspicious activity being represented by suspicious activity sequence elements that are non-contiguous in at least one of the historical sequence and the test sequence; and
applying a non-contiguous sequence alignment algorithm to the historical sequence and the test sequence during a post-event sequence matching process, the non-contiguous sequence alignment algorithm being operative to match the suspicious activity sequence elements of the historical sequence with the suspicious activity sequence elements of the test sequence to thereby detect suspicious activity reflected in the historical system call data collected from the DCS, wherein the non-contiguous sequence alignment algorithm is operative to identify a longest sequence of suspicious activity sequence elements common to the historical sequence and the test sequence, and wherein applying a non-contiguous sequence alignment algorithm comprises use of a biological sequence matching algorithm.
16. A computing device for digital forensic analysis, the computing device comprising:
a processor for executing computer readable instructions that, when executed, cause the computing device to:
collect historical system call data from a digital computing system (DCS), the historical system call data corresponding to a plurality of system calls which comprise system calls corresponding to suspicious activity performed on the DCS;
convert the collected historical system call data to form a historical sequence comprising a string of sequence elements in which each system call is represented as solely one sequence element;
select from a system call sequence database a test sequence comprising a string of sequence elements in which each sequence element represents a system call, wherein system calls represented in the test sequence correspond to the suspicious activity performed on the DCS, the system calls which correspond to the suspicious activity being represented by suspicious activity sequence elements that are non-contiguous in at least one of the historical sequence and the test sequence; and
apply a non-contiguous sequence alignment algorithm to the historical sequence and the test sequence during a post-event sequence matching process, the non-contiguous sequence alignment algorithm being operative to match the suspicious activity sequence elements of the historical sequence with the suspicious activity sequence elements of the test sequence to thereby detect suspicious activity reflected in the historical system call data collected from the DCS, wherein the non-contiguous sequence alignment algorithm is operative to identify a longest sequence of suspicious activity sequence elements common to the historical sequence and the test sequence, and wherein applying a non-contiguous sequence alignment algorithm comprises use of a biological sequence matching algorithm.