AUTOMATED FORENSIC DOCUMENT SIGNATURES

• US 20090164517A1
• Filed: 12/21/2007
• Published: 06/25/2009
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: Georgetown University
• Original Assignee: Georgetown University
• Inventors: Maloof, Marcus A., Frieder, Ophir, SHIELDS, Thomas Clay
• Granted Patent: US 8,280,905 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Methods and systems are provided for a proactive approach for computer forensic investigations. The invention allows organizations anticipating the need for forensic analysis to prepare in advance. Digital signatures are generated proactively for a specified target. The digital signature represents a digest of the content of the target, and can be readily stored. Searching and comparing digital signatures allows quick and accurate identification of targets having identical or similar content. Computational and storage costs are expended in advance, which allow more efficient computer forensic investigations. The present invention can be applied to numerous applications, such as computer forensic evidence gathering, misuse detection, network intrusion detection, and unauthorized network traffic detection and prevention.

Claims

1. A computerized method of proactively generating and comparing computer forensic evidence for a computer system, comprising the steps of:

generating at least one signature for at least one target based on the content of the target; and

comparing the at least one generated signature with at least one previously generated signature to determine whether the signatures have similarities above a predetermined threshold.

2. The method of claim 1, wherein the target is a file.

3. The method of claim 2, wherein the file is owned by a user.

4. The method of claim 2, wherein the file is related to a network intrusion attack.

5. The method of claim 2, wherein the at least one signature is generated upon occurrence of a predetermined operation, and the predetermined operation is one or more of creating, deleting, renaming, editing, moving, updating, linking, merging, modifying and copying the file.

6. The method of claim 1, wherein the target is a database entry.

7. The method of claim 6, wherein the at least one signature is generated upon occurrence of a predetermined operation, and the predetermined operation is one or more of select, insert, update, delete, merge, begin work, commit, rollback, create, drop, truncate, and alter the database entry.

8. The method of claim 1, wherein the target is a database definition.

9. The method of claim 8, wherein the at least one signature is generated upon occurrence of a predetermined operation, and the predetermined operation is one or more of create, drop, and alter the database definition.

10. The method of claim 1, wherein the target is network traffic.

11. The method of claim 10, wherein the at least one signature is generated upon occurrence of a predetermined operation, and the predetermined operation is when the network traffic enters a network or when the network traffic leaves a network.

12. The method of claim 10, wherein the network traffic may be any one or more of a signal protocol, an email, an attachment of an email, an instant message conversation, a text message, a remote login, a virtual private network, a viewed webpage, a file transfer and file sharing of the network traffic.

13. The method of claim 1, wherein generating the at least one signature for the at least one target comprises the steps of:

extracting a set of tokens from the at least one target;

processing the set of tokens;

generating a fingerprint from the set of tokens; and

generating the signature for the at least one target by combining the fingerprints with other related information of the at least one target.

14. The method of claim 13, wherein processing the set of tokens includes sorting the set of tokens.

15. The method of claim 14, wherein processing the set of tokens further includes filtering the set of tokens.

16. The method of claim 13, wherein generating the fingerprint from the set of tokens involves a hash method.

17. The method of claim 13, wherein generating the fingerprint from the set of tokens involves implementation of a bit vector method.

18. The method of claim 13, wherein the other related information of the target is accessible by an operating system, and is at least one of file name, date of record, time of record, user or owner information, network address, network protocol, access history and fingerprint history of the target.

19. The method of claim 13, wherein the other related information of the target is accessible by an application.

20. The method of claim 1, further comprising the step of storing the at least one generated signature in a manner preventing deletion or modification of the at least one generated signature by a user other than authorized personnel or a forensic investigator.

21. The method of claim 1, wherein the at least one generated signature is available to authorized personnel or a forensic investigator with access rights.

22. The method of claim 1, where in the at least one generated signature and respective target are stored on the same computer system.

23. The method of claim 1, where in the at least one generated signature is stored on a first computer system and the at least one target is stored on a second computer system accessible through a computer network.

24. A computer readable medium that configures a computer system to perform a method of proactively generating and comparing computer forensic evidence for a computer system, the method comprising the steps of:

generating at least one signature for at least one target based on the content of the target; and

comparing the at least one generated signature with at least one previously generated signature to determine whether the signatures have similarities above a predetermined threshold.

25. Apparatus for proactively generating and comparing computer forensic evidence;

comprising;

a processor arranged to generate at least one signature for at least one target based on the content of the target; and

a comparator configured to compare the at least one generated signature with at least one previously generated signature to determine whether the signatures have similarities above a predetermined threshold.