AUTOMATED FORENSIC DOCUMENT SIGNATURES

• US 20090164427A1
• Filed: 05/12/2008
• Published: 06/25/2009
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: Georgetown University
• Original Assignee: Georgetown University
• Inventors: Shields, Thomas Clay, Frieder, Ophir, Maloof, Marcus A.
• Granted Patent: US 8,312,023 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/31 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/70 of video data
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/9035 Filtering based on additional data, e.g. user or group profiles
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G10L 15/26 Speech to text systems G10L15/08 takes precedence
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04N 21/44008 involving operations for analysing video streams, e.g. detecting features or characteristics in the video stream arrangements characterised by components specially adapted for monitoring, identification or recognition of video in broadcast systems H04H60/59

Abstract

Methods and systems are provided for a proactive approach for computer forensic investigations. The invention allows organizations anticipating the need for forensic analysis to prepare in advance. Digital representations are generated proactively for a specified target. A digital representation is a digest of the content of the target. Digital representations of a collection of targets indexed and organized in a data structure, such as an inverted index. The searching and comparison of digital representations of a collection of targets allows quick and accurate identification of targets having identical or similar content. Computational and storage costs are expended in advance, which allows more efficient computer forensic investigations. The present invention can be applied to numerous applications, such as computer forensic evidence gathering, misuse detection, network intrusion detection, and unauthorized network traffic detection and prevention.

Claims

1. A computerized method of proactively generating and querying computer forensic evidence for a computer system, comprising the steps of:

generating a representation of content of at least one target within a set of targets; and

generating an inverted index of the set of targets, wherein the inverted index is associated with representations of the content of each target of the set of targets.

2. The method of claim 1, wherein the set of targets comprises one or more files.

3. The method of claim 2, wherein the inverted index is updated upon occurrence of a predetermined operation, and the predetermined operation is one or more of creating, deleting, renaming, editing, moving, updating, linking, merging, modifying and copying a file.

4. The method of claim 1, wherein the set of targets comprises one or more database entries.

5. The method of claim 4, wherein the inverted index is updated upon occurrence of a predetermined operation, and the predetermined operation is one or more of select, insert, update, delete, merge, begin work, commit, rollback, create, drop, truncate, and alter of a database entry.

6. The method of claim 1, wherein generating the representation of the content of at least one target comprises the steps of:

extracting a set of terms from the target; and

processing the set of terms.

7. The method of claim 6, wherein generating the representation of the content of at least one target further comprises the steps of:

extracting other related information of the target;

and incorporating the other related information with the extracted and processed terms.

8. The method of claim 7, wherein the other related information of the target is accessible by an operating system, and is at least one of file name, date of record, time of record, user or owner information, network address, network protocol, and access history of the target.

9. The method of claim 7, wherein the other related information of the target is accessible by an application.

10. The method of claim 1, wherein generating the inverted index of the set of targets comprises the steps of:

extracting a set of terms from the at least one target;

processing the set of terms;

indexing the set of terms to create the inverted index; and

associating the set of terms with representations of the content of each of the one or more targets.

11. The method of claim 1, wherein the representation of the content of the at least one target is stored permanently and is not removed when the target is modified or removed.

12. The method of claim 1, wherein the inverted index retains association with the representation of the content of the at least one target when the target is modified or removed.

13. The method of claim 1, further comprising the step of storing the generated inverted index in a manner preventing deletion or modification of the inverted index by a user other than authorized personnel or a forensic investigator.

14. The method of claim 1, wherein the generated inverted index is available only to authorized personnel or a forensic investigator with access rights.

15. The method of claim 1, wherein the generated inverted index and the set of targets are stored on the same computer system.

16. The method of claim 1, wherein the generated inverted index is stored on a first computer system and the set of targets is stored on a second computer system accessible to the first computer system through a computer network.

17. The method of claim 1, further comprising the step of querying the inverted index.

18. A computer-readable medium that configures a computer system to perform a method of proactively generating and comparing computer forensic evidence for a computer system, the method comprising the steps of:

generating a representation of content of at least one target within a set of targets; and

generating an inverted index of the set of targets, wherein the inverted index is associated with representations of the content of each target of the set of targets.

19. Apparatus for proactively generating and comparing computer forensic evidence, comprising:

a processor arranged to generate a representation of content of at least one target within a set of targets; and

a processor arranged to generate an inverted index of the set of targets, wherein the inverted index is associated with representations of the content of each target of the set of targets.