리눅스와 안드로이드 시스템에서 타임스탬프 조작 식별을 위한 로그 분석 기법
Log Analysis Techniques for Identifying Timestamp Manipulation in Linux and Android Systems
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
디지털 포렌식 분석에서 안티-포렌식 기법에 대응해 디지털 증거의 무결성을 유지하는 것이 중요하다. 타임스탬프가 변조되면 증거 신뢰성이 저하되고 사건 타임라인 구성이 어려워진다. 본 논문은 리눅스와 안드로이드 시스템에서 타임스탬프 변조가 의심될 때 로그 데이터를 수집·분석해 이를 탐지하는 효과적인 기법을 제안한다. 재부팅 시점에서 타임스탬프 변조 여부를 확인하는 새로운 방법도 제시하여 각 운영체제별 타임스탬프 조작 시점을 효과적으로 파악한다. Ubuntu와 CentOS 리눅스, 안드로이드 9와 14를 대상으로 실험하여 제안 기법의 유효성을 검증하였다. 본 기법은 여러 운영체제에서 발생할 수 있는 타임스탬프 조작 공격에 대응하고 디지털 증거의 정확성과 신뢰성을 높이는 데 기여할 수 있다.
Abstract
In digital forensic analysis, maintaining the integrity of digital evidence against anti-forensic techniques is crucial. If timestamps are tampered with, the reliability of the evidence diminishes, complicating the construction of an accurate incident timeline. This paper proposes an effective technique to detect timestamp manipulation by collecting and analyzing log data in cases of suspected tampering in Linux and Android systems. Additionally, we present a new method to verify timestamp manipulation at reboot, identifying tampering times for each operating system. Experiments on Ubuntu and CentOS Linux desktops, as well as Android 9 and 14 phones, demonstrate the technique's validity. This proposed method enhances responses to timestamp manipulation across various OSes, improving the accuracy and reliability of digital evidence.
참고문헌 (12)
- Michael G. Nobleet, "Recovering and Examining Computer Forensic Evidence", Forensic Science Communication, 2(4) (2000)
- Carrie Morgan Whitcomb, "An Historical Perspective of Digital Evidence : A Forensic Scientist's View", International Journal of Digital Evidence, 1(1), pp.7~15 (2002)
- Simon L. Garfinkel, "Anti-forensics : Techniques, detection and countermeasures", INTERNATIONAL CONFERENCE ON INFORMATION WAREFARE AND SECURITY, 2(1), pp.77~84 (2007)
- R. González Arias, "Systematic Review : Anti-Forensic Computer Techniques", Applied Sciences, 14(12) (2024)
- Byeongyeong Yoo, "Analysis of File Time Change by File Manipulation of Linux System", The Journal of the Institute of Internet, Broadcasting and Communication, 16(3), pp.21~28 (2016)
- Murtaza Ahmed, "A Review Of Forensic Analysis Techniques For Android Phones", Journal of Independent Studies and Research - Computing, 15(1), pp.23~30 (2017)
- S. Lee, "Analysis of the Impact of Time Information Manipulation on Logging in Linux and Android", Spring Conference of Korean Institute of Next Generation Computing (2024)
- Bhupendra Singh, "Analyzing windows subsystem for linux metadata to detect timestamp forgery", Advances in Digital Forensics XV: 15th IFIP WG 11.9 International Conference (2019), Springer International Publishing
- Jong-Hwa Song, "A Design of Timestamp Manipulation Detection Method using Storage Performance in NTFS", Journal of Internet of Things and Convergence, 9(6), pp.23~28 (2023)
- Thomas Göbel, "Antiforensics in ext4 : On secrecy and usability of timestamp-based data hiding", Digital Investigation, 24, pp.S111~S120 (2018)
- J. Oh, "Forensic Detection of Timestamp Manipulation for Digital Forensic Investigation", IEEE Access, 12, pp.72544~72565 (2024)
- Sanghyun Lee, "A Study on the Evidence Investigation of Forged", Modulated Time-Stamp at iOS(iPhone, iPad), 2016, pp.5(7), 173~180