A Model for Illegal File Access Tracking Using Windows Logs and Elastic Stack
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The process of tracking suspicious behavior manually on a system and gathering evidence are labor-intensive,variable, and experience-dependent. The system logs are the most important sources for evidences in thisprocess. However, in the Microsoft Windows operating system, the action events are irregular and the logstructure is difficult to audit. In this paper, we propose a model that overcomes these problems and efficientlyanalyzes Microsoft Windows logs. The proposed model extracts lists of both common and key events from theMicrosoft Windows logs to determine detailed actions. In addition, we show an approach based on the proposedmodel applied to track illegal file access. The proposed approach employs three-step tracking templates usingElastic Stack as well as key-event, common-event lists and identify event lists, which enables visualization ofthe data for analysis. Using the three-step model, analysts can adjust the depth of their analysis.
Abstract
The process of tracking suspicious behavior manually on a system and gathering evidence are labor-intensive,variable, and experience-dependent. The system logs are the most important sources for evidences in thisprocess. However, in the Microsoft Windows operating system, the action events are irregular and the logstructure is difficult to audit. In this paper, we propose a model that overcomes these problems and efficientlyanalyzes Microsoft Windows logs. The proposed model extracts lists of both common and key events from theMicrosoft Windows logs to determine detailed actions. In addition, we show an approach based on the proposedmodel applied to track illegal file access. The proposed approach employs three-step tracking templates usingElastic Stack as well as key-event, common-event lists and identify event lists, which enables visualization ofthe data for analysis. Using the three-step model, analysts can adjust the depth of their analysis.
참고문헌 (23)
- A. Nieto, "Cybersecurity profiles based on human-centric IoT devices", Human-centric Computing and Information Sciences, 9 (2019)
- P. K. Sharma, "Li-Fi based on security cloud framework for future IT environment", Human-centric Computing and Information Sciences, 8 (2018)
- "EnCase software" (2021)[URL]
- "Forensic Toolkit (FTK)" (2021)[URL]
- "AXIOM" (2021)[URL]
- "Top 7 PCs shared by world/domestic" (2020)[URL]
- "Best Operating System" (2021)[URL]
- Zhi Zhang, "A Survey on Passive Image Copy-Move Forgery Detection", JIPS(Journal of Information Processing Systems), 14(1), pp.6~31 (2018), 한국정보처리학회[DOI]
- Chengyou Wang, "LBP and DWT Based Fragile Watermarking for Image Authentication", JIPS(Journal of Information Processing Systems), 14(3), pp.666~679 (2018), 한국정보처리학회[DOI]
- "Active Directory Domain Services overview" (2017)[URL]
- J. Kim, "File tracking technique with active directory event log", Proceedings of the 2020 World Congress on Information Technology Applications and Services (2020)
- "Audit policy" (2017)[URL]
- "Advanced security audit policy settings" (2017)[URL]
- "Basic security audit policies" (2017)[URL]
- "5145(S, F): a network share object was checked to see whether client can be granted desired acce" (2017)[URL]
- K. Kim, "Multi-index approach to search Chinese, Japanese, and Korean text with Elasticsearch 6. 6", Proceedings of International Conference on Future Information & Communication Engineering, 11(1), pp.257~260 (2019)
- S. Persada, "Public perceptions of online learning in developing countries : a study using the ELK Stack for sentiment analysis on twitter", International Journal of Emerging Technologies in Learning(iJET), 15(9), pp.94~109 (2020)
- "ELK Stack" (2021)[URL]
- J. Park, "Web artifacts visualization using ElasticSearch and Kibana", Proceedings of the IEEK Summer Conference, pp.1350~1353 (2019)
- 김용준, "Sysmon과 ELK를 이용한 산업제어시스템 사이버 위협 탐지", 정보보호학회논문지, 29(2), pp.331~346 (2019), 한국정보보호학회[DOI]
- 이봉환, "아파치 엘라스틱서치 기반 로그스태시를 이용한 보안로그 분석시스템", 한국정보통신학회논문지, 22(2), pp.382~389 (2018), 한국정보통신학회[DOI]
- J. Kim, "File tracking technique with active directory event log", Proceedings of the 14th KIPS International Conference on Ubiquitous Information Technologies and Applications (2019)
- J. Krause, "Mastering Windows Server 2016" (2016), Packt Publishing