RADAR：揭示未记录的NoSQL操作
RADAR: Exposing Unlogged NoSQL Operations
AI总结：
RADAR通过交叉参考低级存储证据与高级应用日志，揭示NoSQL数据库中未记录的操作，实现日志无关的可信取证。
摘要：
随着NoSQL数据库的广泛应用，数字取证变得越来越困难，因为存储格式多样且往往晦涩，且审计日志不能被假设为可信，当特权内部人员，如DevOps或管理员，能够禁用、压制或操纵日志以掩盖活动时。我们提出了RADAR（记录与证据检测、对齐与报告），这是一个针对日志对手的框架，通过交叉参考低级存储证据与高级应用日志来推导取证真实情况。RADAR分析由自动NoSQL挖掘器（ANOC）重建的证据，该工具直接从原始磁盘字节推断布局并挖掘记录，绕过了数据库API和管理系统，从而将物理存储视为独立的证据来源。RADAR随后将挖掘出的证据与审计日志进行比对，以识别如未记录的插入、沉默删除和字段级更新等存在于磁盘但不在逻辑历史中的delta证据。我们对十种NoSQL引擎进行了评估，包括BerkeleyDB、LMDB、MDBX、etcd、ZODB、Durus、LiteDB、Realm、RavenDB和NitriteDB，涵盖键值存储和文档存储以及多种存储设计，例如写时复制/MVCC、B/B+树和只追加。在日志逃避场景中，如日志压制和维护后攻击，包括历史字节被修剪的情况，RADAR始终能够揭示未归因的操作，同时保持31.7-397 MB/分钟的处理吞吐量，证明了日志无关、可信的NoSQL取证的可行性。
英文摘要：
The widespread adoption of NoSQL databases has made digital forensics increasingly difficult as storage formats are diverse and often opaque, and audit logs cannot be assumed trustworthy when privileged insiders, such as DevOps or administrators, can disable, suppress, or manipulate logging to conceal activity. We present RADAR (Record & Artifact Detection, Alignment & Reporting), a log-adversary-aware framework that derives forensic ground truth by cross-referencing low-level storage artifacts against high-level application logs. RADAR analyzes artifacts reconstructed by the Automated NoSQL Carver (ANOC), which infers layouts and carves records directly from raw disk bytes, bypassing database APIs and the management system entirely, thereby treating physical storage as the independent evidence source. RADAR then reconciles carved artifacts with the audit log to identify delta artifacts such as unlogged insertions, silent deletions, and field-level updates that exist on disk but are absent from the logical history. We evaluate RADAR across ten NoSQL engines, including BerkeleyDB, LMDB, MDBX, etcd, ZODB, Durus, LiteDB, Realm, RavenDB, and NitriteDB, spanning key-value and document stores and multiple storage designs, e.g., copy-on-write/MVCC, B/B+ tree, and append-only. Under log-evasion scenarios, such as log suppression and post-maintenance attacks, including cases where historical bytes are pruned, RADAR consistently exposes unattributed operations while sustaining 31.7-397 MB/min processing throughput, demonstrating the feasibility of log-independent, trustworthy NoSQL forensics.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
