Forensic analysis
A forensic analysis method performed in respect of an endpoint device connected to a computer network. The forensic analysis method comprises collecting file system call data from the endpoint device. The file system call data corresponds to a plurality of system calls relating to file system operations arising from activity performed on the endpoint device. The forensic analysis method also comprises collecting network communication metadata from the endpoint device. The network communication metadata is based on a plurality of system calls relating to communication operations over the computer network arising from activity performed on the endpoint device. The forensic analysis method further comprises detecting first candidate data comprised in one of the collected file system call data and the collected network communication metadata and identifying second candidate data in the other of the collected file system call data and the collected network communication metadata with the second candidate data corresponding to the first candidate data. The forensic analysis method yet further comprises analysing the second candidate data to determine whether or not the first and second candidate data correspond to suspect activity performed on the endpoint device.
1. A forensic analysis method performed in respect of an endpoint device connected to a computer network, the method comprising:
collecting file system call data from the endpoint device, the file system call data corresponding to a plurality of system calls relating to file system operations arising from activity performed on the endpoint device, wherein the file system call data is collected by a software wrapper that intercepts or receives notifications about system calls made by any program running in a kernel or a user space of the endpoint device;
collecting network communication metadata from the endpoint device, the network communication metadata being based on a plurality of system calls relating to communication operations over the computer network arising from activity performed on the endpoint device, wherein the network communication metadata is collected by an operating system network activity monitor; detecting first candidate data comprised in the collected network communication metadata by determining a number of communication system calls to a particular network node in the computer network within a predetermined time window and determining whether the number of communication system calls to the particular network node is greater than a predetermined number;
identifying second candidate data in the collected file system call data, the second candidate data corresponding to the first candidate data by:
when each file system call data comprises a time element and each network communication metadata comprises a timestamp, identifying the second candidate data based on the time element and the timestamp being within a predetermined time of each other; and
when each file system call data comprises a first process identifier and the network communication metadata comprises a second process identifier,
identifying the second candidate data based on the first process identifier and the second process identifier being the same; and
analyzing the second candidate data to determine whether or not the first and second candidate data correspond to suspect activity performed on the endpoint device.
2. The forensic analysis method according to claim 1 wherein the network communication metadata comprises process identifier, source IP/port identifier, protocol, protocol version, timestamp and number of bytes transferred.
3. The forensic analysis method according to claim 1 wherein said detecting first candidate data includes comparing at least one characteristic of the collected system call data with at least one predetermined characteristic of network communication metadata, the at least one predetermined characteristic being indicative of suspect activity being performed on the endpoint device.
4. The forensic analysis method according to claim 1 wherein said detecting first candidate data comprised in the collected network communication metadata depends on an amount of data involved in at least one communication system call.
5. The forensic analysis method according to claim 1 wherein each system call data comprises a first process name and the network communication metadata comprises a second process name and wherein the step of identifying second candidate data corresponding to the first candidate data comprises identifying the second candidate data in dependence on the first and second process names are the same.
6. The forensic analysis method according to claim 1 wherein the second candidate data is identified in the collected file system call data and said analyzing the second candidate data comprises: comparing at least one characteristic of the second candidate data with at least one predetermined characteristic of file system call data, the at least one predetermined characteristic of file system call data being indicative of suspect activity being performed on the endpoint device; and determining if there is a match between the compared second candidate data and the at least one predetermined characteristic of file system call data.
7. The forensic analysis method according to claim 6 wherein the at least one characteristic comprises at least one file command comprised in the file system call data.
8. The forensic analysis method according to claim 7 wherein the at least one file command comprises at least one of: file create; file read; file write; file delete; file rename; and file move.
9. The forensic analysis method according to claim 1 further comprising identifying an event based on said analyzing the second candidate system call data, the event being one of a file upload event and a file download event.
10. The forensic analysis method according to claim 9 wherein identifying the event comprises recording data pertaining to the event, the data pertaining to the event comprising at least one of: date and time; machine identifier; username; application identifier; activity identifier; and resource identifier.
11. The forensic analysis method according to claim 9 further comprising retrieving at least one file that is the object of the identified event, the at least one file being retrieved in dependence on at least one of the first and second candidate data.
12. The forensic analysis method according to claim 1 further comprising storing each of the collected file system call data and the collected network communication metadata in the endpoint device by way of at least one of: for a predetermined period; and in data storage of predetermined size.
13. The forensic analysis method according to claim 1 wherein at least one of the file system call data and the network communication metadata is collected at an interface between the kernel and the user space.
14. A non-transitory medium that stores executable program instructions for causing an endpoint device to perform a method comprising:
collecting file system call data from the endpoint device, the file system call data corresponding to a plurality of system calls relating to file system operations arising from activity performed on the endpoint device, wherein the file system call data is collected by a software wrapper that intercepts or receives notifications about system calls made by any program running in a kernel or a user space of the endpoint device;
collecting network communication metadata from the endpoint device, the network communication metadata being based on a plurality of system calls relating to communication operations over the computer network arising from activity performed on the endpoint device, wherein the network communication metadata is collected by an operating system network activity monitor;
detecting first candidate data comprised in the collected network communication metadata by determining a number of communication system calls to a particular network node in the computer network within a predetermined time window and determining whether the number of communication system calls to the particular network node is greater than a predetermined number;
identifying second candidate data in the collected file system call data, the second candidate data corresponding to the first candidate data by:
when each file system call data comprises a time element and each network communication metadata comprises a timestamp, identifying the second candidate data based on the time element and the timestamp being within a predetermined time of each other; and
when each file system call data comprises a first process identifier and the network communication metadata comprises a second process identifier,
identifying the second candidate data based on the first process identifier and the second process identifier being the same; and
analyzing the second candidate data to determine whether or not the first and second candidate data correspond to suspect activity performed on the endpoint device.
15. The non-transitory medium of claim 14 , wherein the network communication metadata comprises process identifier, source IP/port identifier, protocol, protocol version, timestamp and number of bytes transferred.
16. The non-transitory medium of claim 14 , wherein said detecting first candidate data includes comparing at least one characteristic of the collected system call data with at least one predetermined characteristic of network communication metadata, the at least one predetermined characteristic being indicative of suspect activity being performed on the endpoint device.
17. The non-transitory medium of claim 14 , wherein said detecting first candidate data comprised in the collected network communication metadata depends on an amount of data involved in at least one communication system call.
18. The non-transitory medium of claim 14 , wherein each system call data comprises a first process name and the network communication metadata comprises a second process name and wherein the step of identifying second candidate data corresponding to the first candidate data comprises identifying the second candidate data in dependence on the first and second process names are the same.
19. The non-transitory medium of claim 14 , wherein the second candidate data is identified in the collected file system call data and said analyzing the second candidate data comprises: comparing at least one characteristic of the second candidate data with at least one predetermined characteristic of file system call data, the at least one predetermined characteristic of file system call data being indicative of suspect activity being performed on the endpoint device; and determining if there is a match between the compared second candidate data and the at least one predetermined characteristic of file system call data.
20. The non-transitory medium of claim 19 , wherein the at least one characteristic comprises at least one file command comprised in the file system call data.
21. The non-transitory medium of claim 20 , wherein the at least one file command comprises at least one of: file create; file read; file write; file delete; file rename; and file move.
22. The non-transitory medium of claim 14 , wherein the method further comprises identifying an event based on said analyzing the second candidate system call data, the event being one of a file upload event and a file download event.
23. The non-transitory medium of claim 22 , wherein identifying the event comprises recording data pertaining to the event, the data pertaining to the event comprising at least one of: date and time; machine identifier; username; application identifier; activity identifier; and resource identifier.
24. The non-transitory medium of claim 22 , wherein the method further comprises retrieving at least one file that is the object of the identified event, the at least one file being retrieved in dependence on at least one of the first and second candidate data.
25. The non-transitory medium of claim 14 , wherein the method further comprises storing each of the collected file system call data and the collected network communication metadata in the endpoint device by way of at least one of: for a predetermined period; and in data storage of predetermined size.
26. The non-transitory medium of claim 14 , wherein at least one of the file system call data and the network communication metadata is collected at an interface between the kernel and the user space.