Digital Forensics Event Graph Reconstruction
Ontological data representation and data normalization can provide a structured way to correlate digital artifacts and reduce the amount of data that a forensics investigator needs to process in order to understand the sequence of events that happened on a system. However, ontology processing suffers from large disk consumption and a high computational cost. This paper presents Property Graph Event Reconstruction (PGER), a data normalization and event correlation system that utilizes a native graph database to store event data. This storage method leverages zero index traversals. PGER reduces the processing time of event correlation grammars by up to a factor of 9.9 times over a system that uses a relational database based approach.
KeywordsGraph database Digital forensics Property graph Ontology Event reconstruction
The views expressed in this document are those of the author and do not reflect the official policy or position of the United States Air Force, the United States Department of Defense or the United States Government. This material is declared a work of the U.S. Government and is not subject to copyright protection in the United States.
- 1.Angles, R.: A comparison of current graph database models. In: Proceedings of IEEE 28th International Conference on Data Engineering Workshops, ICDEW 2012, pp. 171–177. IEEE (2012). https://doi.org/10.1109/ICDEW.2012.31
- 2.Bureau of Labor Statistics: Occupational Outlook Handbook: Forensic Science Technicians (2017). https://www.bls.gov/ooh/life-physical-and-social-science/forensic-science-technicians.htm
- 3.Bureau of Labor Statistics: Occupational Outlook Handbook: Information Security Analysts (2017). https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm
- 6.Chabot, Y., Bertaux, A., Nicolle, C., Kechadi, M.T.: A complete formalized knowledge representation model for advanced digital forensics timeline analysis. Digit. Investig. 11, S95–S105 (2014). https://doi.org/10.1016/j.diin.2014.05.009. http://www.sciencedirect.com/science/article/pii/S1742287614000528CrossRefGoogle Scholar
- 8.Chao, J., Graphista, N.: Graph Databases for Beginners: Native vs. Non-Native Graph Technology (2016). https://neo4j.com/blog/native-vs-non-native-graph-technology/
- 10.GraphAware: GraphAware Neo4j TimeTree (2018). https://github.com/graphaware/neo4j-timetree
- 11.Gu\(\eth \)jonssón, K.: Mastering the Super Timeline With log2timeline (2010). https://www.sans.org/reading-room/whitepapers/logging/mastering-super-timeline-log2timeline-33438
- 14.Khan, M.N., Mnakhansussexacuk, E., Wakeman, I.: Machine Learning for Post-Event Timeline Reconstruction. PGnet (January 2006), 1–4 (2006)Google Scholar
- 16.Okolica, J.S.: Temporal Event Abstraction and Reconstruction. Ph.D. thesis, AFIT (2017)Google Scholar
- 17.Robinson, I., Webber, J., Eifrem, E.: Graph Databases, 2nd edn. O’Reilly Media Inc., Sebastopol (2015)Google Scholar
- 19.Schatz, B., Mohay, G., Clark, A.: Rich Event Representation for Computer Forensics. In: Asia Pacific Industrial Engineering and Management Systems APIEMS 2004, pp. 1–16 (2004)Google Scholar