GrAALF：支持取证审计的图形化分析
GrAALF:Supporting Graphical Analysis of Audit Logs for Forensics
摘要：
系统级审计日志通常在计算机取证中发挥关键作用。它们可以非常详细地捕获程序和用户之间的低级别交互，使其成为恶意用户活动的丰富洞察力和来源。然而，当一台典型的计算机每小时生成超过250万个系统事件时，使用这些日志来发现和了解恶意活动是计算和时间密集型的。我们引入了一个名为GrAALF的图形系统，用于高效地加载、存储、处理、查询和显示系统事件，以支持计算机取证。与其他相关系统（如AIQL [13]和SAQL [12]）相比，GrAALF提供了多种后端存储解决方案的灵活性，易于使用和直观的日志查询，以及（近）实时追溯更长系统事件序列的能力，以帮助识别和隔离攻击。同样重要的是，AIQL和SAQL都不能公开使用，而GrAALF是开源的。GrAALF提供了在主存、关系数据库系统、混合主存-数据库系统和基于图的数据库中存储日志的选择。我们使用多个巨大的系统调用日志文件来比较每个选项的响应性。接下来，在多个现实世界的攻击场景中，我们展示了GrAALF在识别攻击和发现其来源方面的有效性和实用性。因此，GrAALF提供了一个强大的解决方案，用于分析审计日志，以支持计算机取证。
英文摘要：
System-level audit logs often play a critical role in computer forensics. They capture low-level interactions between programs and users in much detail, making them a rich source of insight and provenance on malicious user activity. However, using these logs to discover and understand malicious activities when a typical computer generates more than 2.5 million system events hourly is both compute and time-intensive. We introduce a graphical system called GrAALF for efficiently loading, storing, processing, querying, and displaying system events to support computer forensics. In comparison to other related systems such as AIQL [13] and SAQL [12], GrAALF offers the flexibility of multiple backend storage solutions, easy-to-use and intuitive querying of logs, and the ability to trace back longer sequences of system events in (near) real-time to help identify and isolate attacks. Equally important, both AIQL and SAQL are not available for public use, whereas GrAALF is open-source. GrAALF offers the choice of compactly storing the logs in main memory, in a relational database system, in a hybrid main memory-database system, and a graph-based database. We compare the responsiveness of each of these options, using multiple huge system-call log files. Next, in multiple real-world attack scenarios, we demonstrate the efficacy and usefulness of GrAALF in identifying the attack and discovering its provenance. Consequently, GrAALF offers a robust solution for analysis of audit logs to support computer forensics.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
