Backtracking intrusions

Abstract

Analyzing intrusions today is an arduous, largely manual task because system administrators lack the information and tools needed to understand easily the sequence of steps that occurred in an attack. The goal of BackTracker is to identify automatically potential sequences of steps that occurred in an intrusion. Starting with a single detection point (e.g., a suspicious file), BackTracker identifies files and processes that could have affected that detection point and displays chains of events in a dependency graph. We use BackTracker to analyze several real attacks against computers that we set up as honeypots. In each case, BackTracker is able to highlight effectively the entry point used to gain access to the system and the sequence of steps from that entry point to the point at which we noticed the intrusion. The logging required to support BackTracker added 9% overhead in running time and generated 1.2 GB per day of log data for an operating-system intensive workload.

Assisted deletion of related content

“…Related work in forensics includes Backtracker [21], a tool to identify the events leading to a malicious file operation. Backtracker tracks all system calls through virtualization or kernel introspection and displays a graph of the relevant events.…”

“…None of those approaches consider easy secure deletion for content that is replicated across different files. To identify files with shared content, previous work has studied information flow [8,21], file provenance [20,36] and causality between files [24]. However, these works were application [20,43] or operating-system specific [36] and required modification of existing systems [13,24,25] or virtualization [16,21].…”

Principles-driven forensic analysis

“…Two tools, BSM (Basic Security Module) [16] and BackTracker [9], gather enhanced data that is useful for forensic analysis, and both must be installed and running on a system before the events to be analyzed occur. The perspective gained from pre-instailation is what gives them an advantage over other tools, though they are usually not used until it is too late, as was the case on the machine in our example intrusion.…”

An empirical study of automatic event reconstruction systems

“…Most often the image of the hard disk is the only evidence available to the investigators. In the presence of such limited information, event reconstruction often becomes a tedious and highly inaccurate effort (King and Chen, 2003).…”

“…However, the reconstruction process in cases of incidents typified by examples one and three (commonly referred to as operational forensic analysis or intrusion analysis (King and Chen, 2003) as opposed to prosecutorial forensic analysis in the case of example two) can often leverage the presence of additional evidence in the form of audit logs. In the past few years, many researchers have developed automated reconstruction systems that rely on a priori audit logging to help the reconstruction effort.…”