Forensic analysis of database tampering

Abstract

Mechanisms now exist that detect tampering of a database, through the use of cryptographically-strong hash functions. This paper addresses the next problem, that of determining who, when, and what, by providing a systematic means of performing forensic analysis after such tampering has been uncovered. We introduce a schematic representation termed a "corruption diagram" that aids in intrusion investigation. We use these diagrams to fully analyze the original proposal, that of a linked sequence of hash values. We examine the various kinds of intrusions that are possible, including retroactive, introactive, backdating, and postdating intrusions. We then introduce successively more sophisticated forensic analysis algorithms: the monochromatic, RGB, and polychromatic algorithms, and characterize the "forensic strength" of these algorithms. We show how forensic analysis can efficiently extract a good deal of information concerning a corruption event.

The Tiled Bitmap Forensic Analysis Algorithm

“…Then, during forensic analysis of a subsequent validation that detected tampering, those chains can be rehashed to provide a sequence of truth values (success or failure), which can be used to narrow down "what. " We have elsewhere [7] proposed the Monochromatic, RGB, and Polychromatic forensic analysis algorithms. These algorithms differ in the amount of work necessary during normal processing (computing additional hash chains during periodic validation) and the precision of the when and what estimates produced by forensic analysis.…”

“…Avoiding tamper detection comes down to inverting the cryptographically-strong one-way hash function. An extensive presentation of the approach, performance limitations, tamper detection, threat model and other forensic analysis algorithms can be found elsewhere [8], [10].…”

“…This funkySort function ( Figure 6) creates the sequence of indices which when used to index into the C t,k array will result in the ordering of the candidate set elements. This is achieved by performing a single pass over the indices array and creating each new index by manipulating appropriately previous ones (lines [8][9][10][11][12][13] within the funkySort function.…”

“…Elsewhere we have introduced the Monochromatic, the RGB, and Polychromatic Algorithms [7]. All algorithms employ the same approach of tamper detection and forensic analysis by hashing transaction data and periodically validating the resulting hash chains.…”

“…On the other hand it suffers from false positives while the previous three algorithms do not. (More information on the rate of false positives of the Tiled Bitmap Algorithm can be found elsewhere [8].) Table III shows the running time for three of the forensic analysis algorithms (the Polychromatic Algorithm is omitted because it is replaced by the Tiled Bitmap Algorithm).…”