WO2014105960A1

WO2014105960A1 - Timeline wrinkling system and method

Info

Publication number: WO2014105960A1
Application number: PCT/US2013/077822
Authority: WO
Inventors: David Ross
Original assignee: Mandiant Corporation
Priority date: 2012-12-26
Filing date: 2013-12-26
Publication date: 2014-07-03
Also published as: EP2939167A4; EP2939167A1; US20140181131A1; US9633134B2

Abstract

A method for organizing event data by identifying a primary timeline containing event data, extracting a first timestamp from a first item of the primary timeline, setting a radius around the first timestamp, identifying a second timestamp within the radius, determining whether the second timestamp is already in a wrinkle timeline, and, if not, incorporating the second timestamp into the wrinkle timeline. Event data associated with the first item may be marked and emphasized in the wrinkle timeline. The system may also create one or more indexes of the event data.

Description

TITLE

TIMELINE WRINKLING SYSTEM AND METHOD CROSS-REFERENCE TO RELATED APPLICATION

[0001] This Patent Application claims priority to U.S. Patent Application Serial Number 61/746,019 filed December 26, 2012, and titled Timeline Wrinkling, the entire contents of which is incorporated herein by reference in its entirety.

BACKGROUND

[0002] 1. Field

[0003] The present inventive concept pertains to a system and method of conducting a forensic investigation on a computer system following an incident. The present inventive concept more particularly concerns an improved system and method for organizing and manipulating recorded event data and generating a wrinkle timeline report for display to computer forensics investigators.

[0004] 2. Discussion of Related Art

[0005] As more businesses and governmental entities increasingly rely on computer networks to conduct their operations and store relevant data, security of these networks has become increasingly important. The need for increased security is emphasized when these networks are connected to non-secure networks such as the Internet. The preservation of important data and the ability to retrieve and analyze the data in the aftermath of a security breach or incident has become a major focus of forensic investigators.

[0006] Various technologies may be employed to aid in the processing and organizing of data, including search technologies, software that copies the entire contents of the hard drive in a computer system, and software that allows an analyst to review its contents and categorize it based on their observations. Certain of the data stored in computer memory that may be of interest to forensic investigators may be found in log files or timelines, that is, files that contain records of the activities of a computer system as lists of data entries specifying, without limitation, the date/time of events occurring in or in connection with the computer system along with each associated event source (an event source may be a software program which is modified in the computer system thus giving rise to a data entry, such as a timestamp, showing the date/time of the modification and the name of the program). [0007] This sort of log file or timeline analysis may be conducted to determine how a computer system has changed over time. This is helpful in finding indicators of a security breach or determining exactly what has changed when a security breach has occurred so that the changes may be corrected. For example, during a computer security incident, looking at file modification dates in line with the dates and times for various system log entries can help create a picture of the activity an attacker may have engaged in while on a system. Existing methods of examining such data are slow and cumbersome, with the majority relying on finding a particular log entry and "walking" forward and backward in the log file or timeline looking for other entries that might be relevant.

[0008] Thus there exists a need for additional technologies to analyze and manipulate event data and display same in a fashion that increases efficiency of investigation, controls costs and reduces time spent on analysis.

SUMMARY

[0009] In response to aforementioned needs, the present application describes a method and system for organizing and manipulating recorded event data and generating a wrinkle timeline report for display to and use by computer forensics investigators.

[0010] In accordance with an aspect of the present inventive concept, data can be organized and presented following an event by identifying a primary timeline containing event data including a first timestamp, choosing a radius for the first timestamp, searching for other event data within the radius of the first timestamp, and/or generating a wrinkle timeline incorporating at least a portion of or all event data, e.g., identified event data.

[0011] The first timestamp may, in certain embodiments, be identified and used because of its association with a first item that is of interest to the investigator. For example, if the item "install.exe" is of interest to an investigator, he may choose event data for an "AccessQ" event of "install.exe" logged at a certain date and time as the first timestamp. The first timestamp may, in certain embodiments, be identified via a search using parameters corresponding with one or more desired characteristics of the event data. An example of a characteristic includes but is not limited to a type of timestamp and/or a type of item.

[0012] "Event data" as used herein means data associated with an event, e.g., a primary timeline entry for an event recorded by a computer system, a date/time for the event, and/or the like. An "item" as used herein refers to an event source for which event data is stored. For example, if running, accessing, or initializing "install.exe" causes timestamp event data to be recorded and stored, then "install.exe" is considered to be an "item." Each item may have several different types of event data, such as one or more different timestamps associated with it in a primary timeline. A "primary timeline" is a graphical representation of event data, such as that extracted from one or more computer log files, external memory device(s), and/or other like sources configured to contain, store, and/or track data. An "association" as used herein refers to an identifiable relationship or connection. For example, a relationship between an item and a date/time data entry can typically be identified from an event data describing both. Using such a date/time, an investigator is able to make determinations regarding, for example, when one or more items were accessed, used, modified, and/or otherwise manipulated.

[0013] The radius is preferably defined in minutes, thus the investigator may search the primary timeline for event data having time fields within a predetermined number of minutes of the first timestamp, e.g., within any number of minutes. It is foreseen that the radius may be determined using any type and/or combination of measurable units without deviating from the scope of the present inventive concept, e.g., seconds, minutes, hours, days, weeks, months, years, decades, and/or centuries.

[0014] Further, the event data incorporated into the wrinkle timeline might include a second timestamp identified in the search step of the method, a second item associated with the second timestamp, and/or additional event data associated with the second item. The second timestamp may be identified using one or more characteristics selected by default settings of a computing device involved in performance of one or more steps of the method, or may be manually selected by a user; the selected characteristics may include a type of timestamp (e.g., Accessed, Modified, Deleted, Compile Time), a type of item associated with a timestamp (e.g., a type of item, such as a process or program), or other characteristics of the timestamp and/or associated item. The method may further include the step of determining whether event data to be incorporated into the wrinkle timeline is already in the wrinkle timeline, to avoid duplicative entry of event data into the wrinkle timeline. A wrinkle timeline may also be structured or formatted so as to incorporate substantially similar settings of a primary timeline on which it is based, or of another timeline. These settings may include visual styling (such as highlighting item(s) of a specific type) or filters (such as those that omit items where certain criteria are or are not satisfied). These settings may be incorporated into the wrinkle timeline so that some or most of its characteristics (such as functionality, data population, display characteristics, etc.) resemble those of the primary timeline. An investigator in certain embodiments may select event data from the primary timeline to incorporate into the wrinkle timeline, and/or select event data in the wrinkle timeline to remove or emphasize. [0015] The event data of a wrinkle timeline may also be indexed for ease of reference and search. Such an index may be structured substantially similarly to an index maintained in relation to a primary timeline on which it is based, or to another timeline. This may help the event data of the wrinkle timeline behave in a similar fashion as if it were in the primary timeline. The index may, for example, be structured around individual timestamps or content-specific features of items in the wrinkled timeline such as event log item event codes.

[0016] In certain embodiments, event data of the primary timeline will be extracted from an external device. For example, an investigator may define a certain timeframe in which data is desired for examination and request that data from an external device. Returned data may be incorporated into the primary timeline for examination and use in generating a wrinkle timeline.

[0017] The wrinkle timeline may include the first timestamp and/or the first item, and the method may further include the step of marking or visually emphasizing the first timestamp and/or first item to a viewer to assist the viewer in realizing relationships with other event data in the wrinkle timeline. In addition, event data of the primary timeline which is not incorporated into the wrinkle timeline may nonetheless be represented by a visual marking indicating to the investigator that such event data has been removed or was never incorporated from the primary timeline.

[0018] In still another embodiment, an investigator may rely on the wrinkle timeline to build yet another, second, wrinkle timeline using substantially the same techniques used to build the first. While the process may be iterative, and thus perhaps conceptualized similarly to a series of filters in which event data filtered out when creating the first wrinkle timeline would not be available or considered for building the second wrinkle timeline, an investigator may elect to pull event data from the primary timeline or other timelines, along with the first wrinkle timeline, for purposes of constructing the second wrinkle timeline.

[0019] Additional aspects, advantages, and utilities of the present inventive concept will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the present inventive concept. [0020] The foregoing is intended to be illustrative and are not meant in a limiting sense. Many features and subcombinations of the present inventive concept may be made and will be readily evident upon a study of the following specification and accompanying drawings comprising a part thereof. These features and subcombinations may be employed without reference to other features and subcombinations.

BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The present inventive concept is described in detail below with reference to the attached drawing figures, wherein:

[0022] FIG. 1 is a flow chart depicting processing steps of an aspect of the present inventive concept to identify event data along a primary timeline;

[0023] FIG. 2 is a screen shot depicting event data of a primary timeline identified using the present inventive concept; and

[0024] FIG. 3 is a screen shot depicting selection of several timestamps and associated radii using the present inventive concept.

[0025] The drawing figures do not limit the present inventive concept to the specific examples disclosed and described herein. The drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present inventive concept.

DETAILED DESCRIPTION

[0026] The following detailed description references the accompanying drawings that illustrate the present inventive concept. The illustrations and description are intended to describe aspects of the present inventive concept in sufficient detail to enable those skilled in the art to practice the present inventive concept. Other components can be utilized and changes can be made without departing from the scope of the present inventive concept. The following detailed description is, therefore, not to be taken in a limiting sense. The scope of the present inventive concept is defined only by the appended claims, along with the full scope of equivalents to which such claims are entitled.

[0027] In this description, references to "one embodiment," "an embodiment," or "embodiments" mean that the feature or features being referred to are included in at least one aspect of the present inventive concept. Separate references to "one embodiment," "an embodiment," or "embodiments" in this description do not necessarily refer to the same embodiment and are also not mutually exclusive unless so stated and/or except as will be readily apparent to those skilled in the art from the description. For example, a feature, structure, act, etc. described in one embodiment may also be included in other embodiments, but is not necessarily included. Thus, the present inventive concept can include a variety of combinations and/or integrations of the embodiments described herein.

[0028] The software configured to execute various steps or operations of the present inventive concept may reside on many different hardware configurations which would be known to one skilled in the art. The present application describes a method for organizing, analyzing and displaying event data. Data can be organized and presented according to embodiments of the present inventive concept following an event by identifying a primary timeline containing event data including a first timestamp, choosing a radius for the first timestamp, searching for a subset of event data within the radius of the first timestamp, and/or generating a wrinkle timeline incorporating at least a portion or all of the event data.

[0029] Turning now to FIG. 1 , steps for generating and displaying a first wrinkle timeline via the present inventive concept are illustrated. The same or at least substantially similar steps may be repeated by the present inventive concept to generate additional wrinkle timelines, e.g., a second wrinkle timeline, from event data of the first wrinkle timeline.

[0030] As illustrated FIG. 1 , a "Source Item," is selected by a user or investigator from the event data of the Primary Timeline in step 100. The Source Item may be selected by the investigator using one or more computer systems. The shell for the Wrinkle Timeline is then created in step 120. The shell may be created using duplicate settings from the Primary Timeline, but may not initially contain any event data. The duplicate settings may be at least partially or entirely based on data that has been previously stored in a database or memory in communication with and accessibly to the investigator via at least one of the one or more computer systems.

[0031] Timestamps, including a first timestamp, of the Source Item are then extracted or identified in step 130, at which point the investigator is presented with the option of setting or selecting a radius or radii for each timestamp by inputting such into the computer system in step 140, which will be further discussed with respect to FIG. 3 hereafter. Then, for each item in the Primary Timeline and for each timestamp associated with each item, steps 140, 150, and 160 are executed via the computer system, which allow the investigator to search for timestamp event data and populate the timeline with such timestamp event data. In step 140, the event data is analyzed to determine if the event data is within one or more of the selected radii and, if so, compared with other similar timestamps, e.g., based on type of timestamp. Any of the event data that is outside all of the selected radii is separately grouped together, e.g., should the investigator elect to conduct any further analysis on the separate group. If the event data is within one or more of the radii, characteristics of such event data, such as item IDs and timestamps, are compared against event data already populating the Wrinkle Timeline in step 150. If such event data is not already in the Wrinkle Timeline, it is inserted into the Wrinkle Timeline in step 160. Because the event data that fell within the radii are associated with various items, and those items are themselves associated with other event data having time field entries that may fall outside of the radii but nonetheless be relevant, e.g., the separately- grouped event data, an investigator may also insert such separately-grouped event data of any items deemed to be relevant into the Wrinkle Timeline via the computer system. [0032] Optionally, so that the investigator might more easily search the Wrinkle Timeline via the computer system, the event data in the Wrinkle Timeline may be indexed according to various schema, e.g., predetermined schema selected by the Investigator. In a preferred embodiment, the index is structured similarly to the index for the Primary Timeline. Still further, a wrinkle timeline may be modifiable to mark or visually or aurally emphasize the first item (the Source Item in FIG. 1 ) or first timestamp to aid the investigator in identifying or realizing relationships with other event data in the wrinkle timeline. Event data of the primary timeline that is not incorporated into the wrinkle timeline may be marked or visually accounted for in the wrinkle timeline so that the investigator is aware of those gaps. The investigator may rely on the results of the search method in creating a wrinkle timeline, whether by selecting settings for what event data is included in the wrinkle timeline or allowing default settings to do so, and may also manually select event data to exclude or include in the data set incorporated into the wrinkle timeline, or may manually select data in the wrinkle time for exclusion therefrom.

[0033] Turning now to FIG. 2, event data of a primary timeline of the present inventive concept is depicted. As is apparent from FIG. 2, there are a number of methods for filtering or modifying display of the event data of a primary timeline via the computer system, for example to simplify the process of choosing a first timestamp and/or first item. Drop down menus depicted in FIG. 2 allow for selection of a timeframe by the investigator in which the event data must fall in order to be included in the primary timeline. The investigator may also select certain types of event data to be included in the primary timeline. Alternatively, some or all of these settings may be used while selecting a first timestamp or first item, but may then be relaxed or disengaged when the search step of the method is reached so that a more comprehensive set of event data may be searched by the investigator using the computer system.

[0034] It is foreseen that other units of time, such as seconds, hours, days, weeks, months, years, decades, and/or centuries, or any other like, identifiable and comparable characteristics related to and expressed by event data such as physical distance, e.g., physical distance between stored data in a memory, may be used as radii without departing from the spirit of the present inventive concept. It is foreseen that a combination of different types of radii may be used as well, e.g., time and physical distance of one or more portions of the event data. The investigator may select an appropriate radii depending upon the focus of investigation. For example, smaller units of time may be used when focusing on an efficient investigation of higher resolution network events, or larger units may be used for searches of a larger scope and/or to achieve higher accuracy.

[0035] Turning now to FIG. 3, a first item ("install.exe") is depicted with a set of associated timestamps of different types, one of which may be considered the first timestamp. Also depicted are drop down menus allowing the investigator to select a value for a radius for each timestamp. For illustrative purposes, he radii drop down menus of FIG. 3 are measured in minutes. As discussed herein, however, the radii is not limited to such. Generally, during a search for timestamps within, for example, a five minute radius of the first timestamp of the first item, the investigator will look for other event data, such as other timestamps, associated with Date/Time time field entries five minutes before or after the first timestamp.

[0036] The investigator may perform the present inventive concept using an agent in certain embodiments. An agent is a module of software installed on a target system that enables a user to monitor and interact with the target system. Agents allow users to gather information about multiple aspects of the target system. Agents also permit users to remotely retrieve the contents of the target system's memory or hard drive, and could potentially be configured to modify its contents. The agent may be configured to either communicate over a computer network, or to read and write all relevant configuration information and acquired data to a computer storage medium, such as a hard drive or removable read/write media (USB key, etc). In one embodiment, the agent is built in a modular fashion. The ability to gather a particular piece of data from a target system (e.g. a list of running processes on the target system or a primary timeline) is implemented as a discrete module of software and loaded by the agent. This allows for easy adaptation of the agent to different environments that have specific requirements for data collection.

[0037] The previous description of the presently disclosed inventive concept is provided to enable any person skilled in the art to make or use the present inventive concept. Various modifications will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied alternatively without departing from the spirit or scope of the present inventive concept. Thus, the present inventive concept is not intended to be limited to the description herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0038] The steps of a method, system, or operation described in connection with the present inventive concept disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0039] Having now described the features, discoveries and principles of the present inventive aspect of this disclosure, the manner in which the present inventive aspect is constructed and used, the characteristics of the construction, and advantageous, new and useful results obtained; the new and useful structures, devices, elements, arrangements, parts and combinations, are set forth in the appended claims.

[0040] It is also to be understood that the following claims are intended to cover all of the generic and specific features of the present inventive aspect herein described, and all statements of the scope of the present inventive aspect which, as a matter of language, might be said to fall there between.

Claims

CLAIMS What is claimed is:

1. A method of organizing event data using a computer system, the method comprising the steps of:

identifying a primary timeline containing event data including a first timestamp;

choosing a radius for the first timestamp;

searching, via the computer system, for at least one subset of the event data within the radius; and

generating, via the computer system, a first wrinkle timeline incorporating the at least one subset of the event data.

2. The method according to claim 1 , further comprising the step of:

identifying a first item associated with the first timestamp.

3. The method according to claim 2, further comprising the step of:

identifying a second timestamp by the search and a second item associated with the second timestamp.

4. The method according to claim 1 , wherein the step of searching for the at least one subset of the event data within the radius includes identifying one or more timestamp characteristics and comparing the one or more timestamp characteristics to the event data.

5. The method according to claim 3, further comprising the steps of: identifying a third timestamp associated with the second item; and

determining whether the second and third timestamps are present in the first wrinkle timeline.

6. The method according to claim 5, wherein if one or more of the second and third timestamps are determined not to be present in the first wrinkle timeline, the one or more of the second and third timestamps are copied into the first wrinkle timeline.

7. The method according to claim 1 , further comprising the step of: creating an index of the event data of the first wrinkle timeline.

8. The method according to claim 7, wherein the first wrinkle timeline index is substantially similar to an index associated with the primary timeline.

9. The method of claim 1 , wherein the event data of the first wrinkle timeline includes the first timestamp.

10. The method of claim 9, wherein the first timestamp is marked in the first wrinkle timeline.

1 1 . The method of claim 1 , wherein the first wrinkle timeline has substantially the same settings as the primary timeline.

12. The method of claim 1 , wherein the radius is at least partially defined in minutes.

13. The method of claim 1 , further comprising the step of: identifying the first timestamp of the primary timeline using a keyword search.

14. The method of claim 1 , wherein the steps of the method are carried out using a computing device and event data of the primary timeline resides in memory of an external device.

15. The method of claim 14, wherein the primary timeline comprises event data extracted from the external device according to pre-determined parameters.

16. The method of claim 15, wherein the pre-determined parameters define one or more windows of time for comparing against timestamps contained in the memory of the external device.

17. The method of claim 1 , further comprising the step of: creating a visual representation of event data of the primary timeline that is incorporated into the first wrinkle timeline.

18. The method of claim 1 , further comprising the step of: selecting event data to be incorporated into the first wrinkle timeline.

19. The method of claim 1 , further comprising the step of: selecting event data not to be incorporated into the first wrinkle timeline.

20. The method of claim 1 , further comprising the step of: selecting event data to remove from the first wrinkle timeline.

21 . The method of claim 1 , further comprising the step of: marking one or more event data in the first wrinkle timeline.

22. The method of claim 20, further comprising the steps of: identifying a fourth timestamp in the first wrinkle timeline;

choosing a radius for the fourth timestamp;

searching for one or more event data within the radius; and

generating a second wrinkle timeline incorporating at least one of the event data.