Digital Forensics System Call Sequence Alignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Digital forensics faces challenges in efficiently analyzing and interpreting vast amounts of system call data from digital computing systems due to data complexity, fragility, and the need for precise attribution of user actions, especially in identifying malicious activities amidst vast volumes of data.
Innovation Solution
A method involving the collection and conversion of system call data into a sequence format, using biological sequence matching algorithms like Karlin-Altschul statistics, and frequency domain analysis to detect matches and reconstruct user activities, enabling effective intrusion detection and forensic analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional forensic analysis methods are used to examine system call data, then comprehensive evidence collection is possible, but the analysis becomes extremely time-consuming and difficult to interpret due to data complexity and volume
Solution Approach 1:
The patent extracts only the essential and relevant system call sequences from the vast amount of system call data. By focusing on specific sequences that are indicative of malicious activity rather than analyzing all system calls comprehensively, the method reduces analysis time while preserving the most critical forensic evidence.
Solution Approach 2:
The patent creates simplified representations (copies) of system call data in the form of sequences that can be efficiently compared against known malicious patterns. These sequence copies maintain the essential forensic information needed for evidence collection while being much more manageable for analysis than the original raw system call data.
2Measurement precision
If detailed analysis of all system call data is performed to ensure accurate attribution of user actions, then forensic precision is improved, but the complexity of data interpretation increases significantly
Solution Approach 1:
The patent segments system call data into discrete sequences that represent specific user actions or system operations. By dividing the continuous stream of system calls into meaningful segments, the method maintains precision in attributing user actions while reducing the overall complexity of interpretation through structured organization.
Solution Approach 2:
The patent transforms system call data into a different parameter representation (sequences) that preserves the essential information needed for accurate attribution while making the data more suitable for efficient comparison and analysis. This parameter transformation reduces interpretation complexity without sacrificing precision.
3Measurement precision
If biological sequence matching algorithms are used to detect malicious activities, then detection accuracy is improved, but the computational requirements and method complexity increase
Solution Approach 1:
The patent uses biological sequence matching algorithms as an intermediary method to bridge the gap between system call data and malicious activity detection. These algorithms serve as a mediator that translates system call sequences into a format suitable for pattern matching, improving detection accuracy while managing complexity through the use of established bioinformatics tools.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
New digital forensic techniques and systems are disclosed. System call information is collected from a device under test (DUT) and converted to a sequence format. Thereafter, sequence alignment methods and tools can be used to investigate and identify patterns of behaviour that are suspicious.