Cross-Platform File System Activity Monitoring and Forensics — A Semantic Approach

Cross-Platform File System Activity Monitoring and Forensics — A Semantic Approach

Abstract

Ensuring data confidentiality and integrity are key concerns for information security professionals, who typically have to obtain and integrate information from multiple sources to detect unauthorized data modifications and transmissions. The instrumentation that operating systems provide for the monitoring of file system level activity can yield important clues on possible data tampering and exfiltration activity but the raw data that these tools provide is difficult to interpret, contextualize and query. In this paper, we propose and implement an architecture for file system activity log acquisition, extraction, linking and storage that leverages semantic techniques to tackle limitations of existing monitoring approaches in terms of integration, contextualization, and cross-platform interoperability. We illustrate the applicability of the proposed approach in both forensic and monitoring scenarios and conduct a performance evaluation in a virtual setting.

Grafik Top
Authors
  • Kurniawan, Kabul
  • Ekelhart, Andreas
  • Ekaputra, Fajar
  • Kiesling, Elmar
Grafik Top
Shortfacts
Category
Paper in Conference Proceedings or in Workshop Proceedings (Paper)
Event Title
ICT Systems Security and Privacy Protection
Divisions
Security and Privacy
Subjects
Computersicherheit
Angewandte Informatik
Event Location
Virtual Event
Event Type
Conference
Event Dates
21-23 Sept 2020
Publisher
Springer International Publishing
Page Range
pp. 384-397
Date
2020
Export
Grafik Top