Identification and extraction of key forensics indicators of compromise using subject-specific filesystem views

Abstract

Identification and extraction of key forensics indicators of compromise using subject-specific filesystem views are provided. A stackable filesystem that transparently tracks process file writes for forensic analysis. The filesystem comprises a base filesystem, and an overlay filesystem. Processes see the union of the upper and lower filesystems, but process writes are only reflected in the overlay. By providing per-process views of the filesystem using the stackable approach, a forensic analyzer can record a process's file-based activity, i.e., file creation, deletion, modification. These activities are then analyzed to identify indicators of compromise (IoCs). These indicators are then fed into a forensics analysis engine, which then quickly decides whether a subject (e.g., process, user) is malicious. If so, the system takes some proactive action to alert a proper authority, to quarantine the potential attack, or to provide other remediation. The approach enables forensic analysis without requiring file access mediation, or conducting system event-level collection and analysis, making it a lightweight, and non-intrusive solution.

Description

Technical field [0001] The present disclosure generally relates to network security. Background technique [0002] In today's modern digital age, the harm or theft of data can have serious consequences for individuals, governments, enterprises, and the cloud environment. Using data as the new digital currency, cybercrime has become a huge financial business. Criminals steal millions of credit card numbers and hold data ransoms, causing companies to spend millions of dollars to regain access to their data. Facing the alarming speed and scope of recent attacks, new methods are needed to effectively identify and deter attackers who are trying to steal or destroy their target's “crown jewel”. [0003] Existing methods to prevent data theft are only effective in certain situations. For example, current ransomware protection focuses on preventing malware from running, maintaining backups, or trying to reverse engineer custom encryption schemes. Unfortunately, this passive approach has...

AI Technical Summary

Problems solved by technology

That said, techniques to extract this information require file access arbitration, or system event level collection and analysis, which are computationally inefficient and invasive

Images