TARZAN: An Integrated Platform for Security Analysis

Abstract

Abstract-In this paper, we present the TARZAN platform, an integrated platform for analysis of digital data from security incidents. The platform serves primarily as a middleware between data sources and data processing applications, however, it also provides several supporting services and a runtime environment for the applications. The supporting services, such as a data storage, a resource and application registry, a synchronization service, and a distributed computing platform, are utilized by the TARZAN applications for various security-oriented analyses on the integrated data ranging from an IT security incident detection to inference analyses of data from social networks or cryptocurrency transactions. To cope with a large amount of distributed data, both streamed in real-time and stored, and for the need of a large scale distributed computing, the platform has been designed as a big data processing system ensuring reliable, scalable, and cost-effective solution. The platform is demonstrated on the case of a security analysis of network traffic.

Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective

“…Largely composed of identification, collection, preservation, analysis, submission, and verification of evidence [1]- [3], digital forensics is classified into disk forensics, memory forensics, and network forensics depending on the target [4], [5]. Disk forensics analyzes the structure of the disk and recovers deleted files that once existed in the hardware [6], [7].…”