KR20120086926A - A visualization system for Forensics audit data - Google Patents

Abstract

PURPOSE: A forensics audit data visualizing system is provided to monitor the behavior of a user through an intuitive data analysis and quickly detect abnormal behavior by generating forensics audit data from data used in a computer terminal and visualizing the forensics audit data according to each program and use time. CONSTITUTION: A data collecting unit(31) collects data used in a computer terminal in real time. A data filtering unit(32) sorts data obtained by removing data conforming to a fixed rule from the data used in the terminal. An audit data generating unit(33) generates forensic audit data including correlation between a program and the sorted data by obtaining information of the program using the data. A visual converting unit(34) aligns the forensic audit data according to time sequencing. A visualizing module(35) displays the use time the forensic audit data on a time table according to each program using the data.

Description

A visualization system for Forensics audit data}

The present invention relates to a forensic audit data visualization system that visually analyzes a user's behavior using data visualization techniques of forensic audit data collected from computer digital data and audit data.

In particular, the present invention relates to a forensic audit data visualization system that displays a time when data is used in a time table and displays the program data using the data.

In general, computer crime has increased due to the development of computer technology and the popularization of its use. As a result, computer forensic technology for analyzing the purpose of computer use and user's behavior has appeared and developed. Computer forensics aims to acquire and analyze digital evidence, which is obtained from digital data. Digital data is divided into data of a physical storage medium that stores information of a file system, an operating system, and an application in memory, swap, and disk, and network data transmitted and received on a network. Recently, due to the increase of various cyber crimes, the importance of digital data, which can be legal evidence, has been highlighted, and various audit data techniques have been developed to process and store data to collect and audit digital data more systematically and efficiently. It is becoming.

However, because the collected forensic audit data is more than tens or hundreds of GB due to the development of digital storage media, there is a demand for a technology capable of analyzing the collected data more effectively and accurately than the recent data collection method. To this end, various analysis techniques exist in recent years, and one of them is forensic data analysis using the data visualization technique used by the present invention. Data Visualization is a method of representing tens or tens of millions of data as an image, and visually finding patterns that cannot be found in simple data analysis.

Data visualization techniques can quickly process and display large amounts of data, and the advantage of visual analysis is to find any pattern more intuitively than other methods. However, in order to find such a pattern, the learning of a user using a visualization technique should be preceded first.

The present invention is a method of visually showing the use of computer resources (hardware and software) and data used by a user over time from the perspective of a user using a computer using forensic data collected by one of various visualization methods. The present invention rearranges all collected resources in a chronological order and finds an association between system resources and data through correlation analysis between system resource usage and data usage. The processed data can be visually tracked and analyzed over time through user visualization of computer resources and data usage. The present invention enables human forensics to analyze and audit user behavior beyond passive forensic data analysis.

SUMMARY OF THE INVENTION An object of the present invention is to solve the problems described above, and provides a forensic audit data visualization system that visually analyzes a user's behavior using data visualization techniques of forensic audit data collected from computer digital data and audit data. It is.

In other words, due to the advancement of the media, the capacity of the storage media is increasing exponentially. Therefore, it takes a lot of time to perform digital forensics and has many difficulties in the analysis method. The present invention collects computer digital data to create forensic audit data, and analyzes and determines abnormal behavior of a user through data visualization techniques.

In particular, it is an object of the present invention to provide a forensic audit data visualization system for displaying the time the data is used in a time table, for each program using the data.

In order to achieve the above object, the present invention relates to a forensic audit data visualization system installed in a computer terminal, collecting data used in the computer terminal, and visualizing and displaying the data according to the time used. A data collector for collecting data used in real time; A data filter unit for removing data in accordance with a predetermined rule from the collected data and selecting the remaining data; An audit data generator for acquiring program information using the screening data with respect to screened data (hereinafter, screening data) and generating forensic audit data including a correlation between the screening data and a program; A visual converter for sorting the forensic audit data according to a time sequence and sorting the program information with a correlation; And a visualization module unit displaying a time for which the forensic audit data is used in a time table and displaying the program for each program using the data.

The present invention also relates to a forensic audit data visualization system installed in a computer terminal and collecting data used in the computer terminal and visualizing and displaying the data according to the time used. A data collecting unit collecting information at a specific time; A data filter unit for removing data in accordance with a predetermined rule from the collected data and selecting the remaining data; An audit data generator for acquiring program information using the screening data with respect to screened data (hereinafter, screening data) and generating forensic audit data including a correlation between the screening data and a program; A visual converter for sorting the forensic audit data according to a time sequence and sorting the program information with a correlation; And a visualization module unit displaying a time for which the forensic audit data is used in a time table and displaying the program for each program using the data.

The present invention is a forensic audit data visualization system, characterized in that the time table is composed of a column for displaying the passage of time and a row for displaying a program.

The present invention provides a forensic audit data visualization system, wherein the visualization module unit displays a bar between a time at which a program starts and an end time (hereinafter, referred to as a duration) in a row of the time table, and displays the program on the bar. It is characterized in that the information of the data used by the program is displayed within the duration of time.

In addition, the present invention is a forensic audit data visualization system, the visualization module, characterized in that when the pointer on the bar displays the data used by the program corresponding to the bar during the corresponding time and connects to the original data and links .

In another aspect, the present invention provides a forensic audit data visualization system, wherein the visualization module unit displays the data according to the type of storage medium, the type of the storage medium is divided into physical storage device data type and network data type, The physical storage device data type is divided into a disk data type and a memory data type, the disk data type is divided into a file system data type and a swap data type, and the network data type is divided into a packet data type and a network log type. It features.

As described above, according to the forensic audit data visualization system according to the present invention, by analyzing forensic audit data to enable the user behavior analysis of the data used in the computer terminal, the analyst by visualizing the data for each use time and program, Intuitively, the data can be analyzed to track the behavior of computer users and to quickly detect anomalies.

In other words, the data collected for forensic audits (hereafter forensic audit data) is more than tens or hundreds of gigabytes, which requires much human and time resources for analysts to analyze them. Through the visualization system of the present invention, it is possible to intuitively track and audit user behaviors, and finally, human forensics that can analyze and determine user abnormal behaviors.

1 is a diagram showing an example of the overall system configuration for implementing the present invention.
2 is a block diagram of the configuration of a forensic audit data visualization system according to an embodiment of the present invention.
3 is a diagram illustrating types of digital data according to an embodiment of the present invention.
4 is a diagram illustrating an example of forensic audit data according to the present invention.
5 is a diagram illustrating an example of visualization of forensic audit data according to the present invention.

Description of the Related Art [0002]
10: computer system 20: network
30: data visualization system 31: data collector
32: data filter unit 33: audit data generation unit
34: visual transformation unit 35: visualization module unit
40: permanent storage 50: digital data

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In addition, in describing this invention, the same code | symbol is attached | subjected and the repeated description is abbreviate | omitted.

First, examples of the configuration of the entire system for implementing the present invention will be described with reference to FIG.

As shown in FIG. 1A or 1B, the forensic audit data visualization system according to the present invention may be implemented as a server system on a network or a program system on a computer system.

As shown in FIG. 1A, one example of a complete system for practicing the present invention is composed of a computer system 10 and an audit data visualization system 30 and connected to each other via a network 20. In addition, a database 40 for storing necessary data may be further provided.

The computer system 10 is a conventional computing terminal such as a PC, a notebook, a netbook, a PDA, a mobile, and the like used by a general user.

The data visualization system 30 connects to the computer system 10 via the network 20 as a conventional server, and collects information such as data stored in the terminal or the like used by the user. The visualization system 30 examines the computer system 10 used by the user, analyzes the collected data, and analyzes the user's behavior therefrom.

The database 40 stores data collected by the computer system 10 or data collected by analyzing the collected data.

As illustrated in FIG. 1B, another example of the entire system for implementing the present invention may be configured as a data visualization system 30 in the form of a program installed in the computer system 10. That is, each function of the data visualization system 30 is implemented as a computer program and installed in the computer system 10 to collect the use state of the computer system 10 in real time, or to use the computer system 10 at a specific point in time. Collect the state.

In this case, the usage state of the computer system is mainly to collect data stored in a storage medium such as a hard disk, a memory, a swap memory, a network memory, and the like. The collected data is stored in an external database (or storage medium) or in a predetermined storage space of the computer system 10. This storage space will be referred to as permanent storage (40).

Next, the configuration of the forensic audit data visualization system 30 according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

2, the visualization system 30 collects digital data of a computer to generate forensic audit data, and visualizes the data through a data visualization technique.

As shown in FIG. 2, the data visualization system 30 according to an exemplary embodiment of the present invention may include a data collector 31, a data filter unit 32, an audit data generator 33, and a visual converter 34. And a visualization module unit 35.

The data collector 31 collects digital data of the computer system 10.

The data collection unit 31 is installed in the computer system 10 to collect digital data in real time. Collecting data in real time allows you to collect more diverse and detailed data and information.

In another embodiment, the data collector 31 collects temporary data. At this time, the collected digital data is limited and not rich.

Therefore, the data visualization of the present invention can be visualized according to the content and capacity of the collected data, so the present invention excludes the collection method and procedure, but it is possible to visualize both real-time and temporary data. .

As shown in FIG. 3, the digital data collected by the data collector 31 may be classified according to a storage location (or a storage medium). That is, the digital data of the computer system 10 used by the user is largely divided into physical storage device data type and network data type. The physical storage data type refers to data stored in a physical storage medium such as a hard disk, a solid state disk (SSD), or a USB memory. The network data type refers to data such as packets transmitted and received by connecting to a network such as the Internet or a local area network.

The physical storage device data type is divided into a disk data type and a memory data type. In addition, the disk data type is divided into a file system data type and a swap data type. The file system data type is data by the file system, and the swap data type refers to data temporarily stored for swapping data recorded in a memory or the like.

The network data type is divided into a packet data type and a network log type. The packet data type is data actually transmitted / received through a network such as a packet, and the network log type refers to log data that records and stores the state of the network in time.

The data collection unit 31 stores the digital data thus collected in the database (or permanent storage) 40. This can prevent original data corruption in digital forensics. The digital data collected is tens or hundreds of gigabytes, and the range of digital data is so diverse that pre-processing for screening and visualizing the appropriate data is required.

The data filter unit 32 removes unnecessary information from the collected data and selects necessary information. At this time, the data filter unit 32 removes unnecessary data according to a predetermined rule. For example, the data filter unit 32 excludes libraries and system files used in the operating system and software as unnecessary information by the rule.

On the other hand, the data filter unit 32 may receive the input to specify the unnecessary file directly from the analyst can exclude the data. That is, the data filter unit 32 allows the analyst to directly select and designate.

The audit data generator 33 analyzes the correlation between the data previously selected by the data filter 32 and generates forensic audit data so that the user's behavior can be analyzed over time. In particular, the audit data generation unit 33 obtains program information using the screening data with respect to the screened data (hereinafter, screening data), and includes forensic audit data (Forensics) including a correlation between the screening data and the program. create audit data).

In particular, the audit data generating unit 33 searches for a program using each screening data to form a correlation between the screening data and the program. That is, if a specific program uses (opens, modifies, references, etc.) the screening data used at a specific time, the specific program and the screening data are said to be correlated with each other.

The structure of forensic audit data is configured as shown in FIG.

As shown in FIG. 4, all forensic audit data stores a timestamp so as to know a use time. In addition, the program indicates which program the audit data correlates with, and displays the data type and the like. It also includes information that can identify the data, such as the data name.

On the other hand, the audit data generating unit 33 determines the start time and end time of the program, the use time of the audit data, and the like. The data collection unit 31 may collect such time information in real time, or may analyze the data collected at a specific time to estimate such time information.

First, an example of collecting data in real time will be described.

Estimation of start and end time of a program can be done by installing a monitoring program (agent) on the computer and knowing when the program started and ended.

All programs are stored in the hard disk (C: \ programfiles in Windows). When executed by the user, the program is executed as one process. The currently running process can be checked through the task manager in Windows and process status command (PS command) in Linux. This information can be fully implemented through system programming (information extraction using system libraries), and some source code and programming methods are shown.

In the case of a network, a timestamp is recorded in a network packet used in all programs so that the data can be known to go out and in. This is recorded by an operating system. A way to see this in the middle is enough with system programming. In other words, development is generally achieved through raw socket programming or programming using PCAP (packet capture program).

System programming is a method of obtaining or controlling system information by using a library provided by the operating system. Through this, various information such as process and network information and file system information used by the operating system can be collected. Prevention programs such as all monitoring programs and surveillance and vaccine programs (v3, etc.) are being developed through system programming.

Next, the case of collecting data temporarily (or only at a specific time) will be described. In the case of temporary data, forensic data is collected using a tool such as a forensic tool from the information of the computer in operation. Such data cannot be found much compared to real-time data, but information can be confirmed using some data.

First, the start time and the end time of a process executed in the temporary data can be checked. For example, the time of the time is estimated using data (file, temporary file, log, cookie, etc.) used by the program.

In other words, if the user uses a word process, the user must have created a single document file or opened an existing document file. This time can be found by checking the last access (access) time. Then check the file's system information to see the last modified time.

In addition, if the file uses a word processor of a specific product, you can examine the extension and the list of installed programs (C: \ Program Files) to find out which program was used. In other words, you can use the last accessed date to estimate when the file was opened. The exact start and end times of the program cannot be determined, but can be confirmed by the last access time.

In addition, in the case of network access, if a user visits and uses a specific site through a web browser, all the information accessed by the web browser is stored in a web temporary folder, which includes the site information, image files, cookies, and ActiveX information. Etc. can be confirmed.

In the case of temporary data, the operating information of the operating system in the memory can be checked through various commands of Windows. For example, in the case of the netstat -b -v command, you can check the network connection information used by the current process.

Various collection system information can be collected using a conventional application (EnCase), such as a tool. However, compared to real-time data collection, temporary data collection is difficult to collect information that can monitor all the situation of the system. Therefore, as in the above example, specific rules are made in advance, and the duration or the like of the program or file is found or estimated according to the created rules.

The visual converter 34 sorts the data of the forensic audit data generated by the audit data generator 33 according to the order of time. In particular, the visual converter 34 sorts the data based on a used program according to a specific time. At this time, the program is data correlated with the audit data.

Data generated by all computers is generated by computer users, and their actions are performed through programs. Thus, sorting the operating program over time and tracking the data associated with the operating program allows the user to analyze and track the behavior during that series of time.

The visualization module 35 visualizes the processed data so that the analyst can intuitively analyze the data. That is, the visualization module 35 displays a bar between the time when the program is started and the time when the program is ended (hereinafter, referred to as a duration) in the row of the time table, and is used by the program within the duration of the program on the bar. Display information about the generated data.

An example of the configuration of the visualization that the final analyst can analyze is shown in FIG. 5.

As shown in FIG. 5, the time division is divided according to the start time and the end time of the computer. In other words, the computer is turned on and operated three times in total. Divide the time by the computer's operating time and divide each by t hours. In each section, the bar graph 700 represents a time when the programs are operated at a specific time, and the size of the bar graph represents the time when the program is operated.

In addition, the visualization module 35 displays the data used by the program corresponding to the bar during the corresponding time when the pointer is placed on the bar, and links the original data with the link.

In addition, the visualization module 35 bundles and displays the data according to the type of storage medium. That is, the bar graph displays the used disk data 800, the memory data 900, and the network data 1000 according to the time when the program is operated. Each data is stored in the permanent storage 40. Is linked. This allows the analyst to intuitively analyze the user's behavior and each piece of information over time.

Next, the effect of this invention is demonstrated more concretely.

As described above, the visualization system 30 according to the present invention visualizes and displays the forensic data collected by one of various visualization methods over time from the user's point of view. It is a visual representation of the computer resource (hardware and software) usage and data used by the user.

That is, the visualization system 30 rearranges all collected resources in a chronological order and finds an association between system resources and data through correlation analysis between system resource usage and data usage. This processed data can be visually tracked and analyzed over time through the visualization of the user's computer resources and data usage.

Through this, the visualization system 30 according to the present invention is capable of human forensics that can analyze and audit user behavior beyond passive forensic data analysis.

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the Example, this invention is not limited to an Example and can be variously changed in the range which does not deviate from the summary.

The present invention is useful for developing a forensic audit data visualization system that visually analyzes user behavior using forensic audit data collected from computer digital data and audit data.

Claims (6)

In the forensic audit data visualization system installed in the computer terminal, collecting the data used in the computer terminal, and visualized and displayed according to the time used for the data,
A data collector configured to collect data used in the computer terminal in real time;
A data filter unit for removing data in accordance with a predetermined rule from the collected data and selecting the remaining data;
An audit data generator for acquiring program information using the screening data with respect to screened data (hereinafter, screening data) and generating forensic audit data including a correlation between the screening data and a program;
A visual converter for sorting the forensic audit data according to a time sequence and sorting the program information with a correlation; And,
Forensic audit data visualization system, characterized in that it comprises a visualization module for displaying the time the forensic audit data is used in a time table, for each program using the data.
In the forensic audit data visualization system installed in the computer terminal, collecting the data used in the computer terminal, and visualized and displayed according to the time used for the data,
A data collector configured to collect data information used in the computer terminal at a specific time;
A data filter unit for removing data in accordance with a predetermined rule from the collected data and selecting the remaining data;
An audit data generator for acquiring program information using the screening data with respect to screened data (hereinafter, screening data) and generating forensic audit data including a correlation between the screening data and a program;
A visual converter for sorting the forensic audit data according to a time sequence and sorting the program information with a correlation; And,
Forensic audit data visualization system, characterized in that it comprises a visualization module for displaying the time the forensic audit data is used in a time table, for each program using the data.
The method according to claim 1 or 2,
The forensic audit data visualization system, characterized in that the time table is composed of a column for displaying the passage of time and a row for displaying a program.
The method of claim 3,
The visualization module unit displays, in a row of the time table, a bar between a time at which a program starts and a time at which it ends (hereinafter, referred to as a duration), and information on data used by the program within the duration of the program on the bar. Forensic audit data visualization system, characterized in that for displaying.
The method of claim 4, wherein
The forensic audit data visualization system, wherein the visualization module unit displays the data used by the program corresponding to the bar during the corresponding time when the pointer is placed on the bar and links the original data with a link.
The method according to claim 1 or 2,
The visualization module unit bundles and displays data according to the type of storage medium,
The type of storage medium is divided into a physical storage device data type and a network data type, the physical storage device data type is divided into a disk data type and a memory data type, and the disk data type is a file system data type and a swap data type. And the network data type is divided into a packet data type and a network log type.

Images