1. Enhancing Critical Infrastructure Protection with innovative SECurity framework
Digital Forensics via AEGIS Visualization toolkit
16/10/2018
Leonidas Kallipolitis, AEGIS
The research leading to these results has received funding from the European Union’s Horizon 2020 Research and Innovation Programme, under Grant Agreement no

2. Introduction - Definitions
Computer Forensics: Computer forensics is the scientific examination and analysis of data held on, or retrieved from, computer storage media in such a way that the information can be used as evidence in a court of law.
Electronic record: any data that is recorded or preserved on any medium in or by a computer system or other similar device, that can be read or perceived by a person or a computer system or other similar device. It includes a display, printout or other output of that data.
Critical Infrastructure: those "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”
(USA Patriot Act of 2001)

3. Industrial challenges
The statement [1]: “Europe must create conditions to support European start-ups and emerging/promising cyber-technologies like a European SIEM and Forensics Data Analytics”
Security data is growing,
organizations collect, process, and analyze more than six terabytes of security data monthly [2].
Difficult to keep up with the threat landscape
organizations are being overwhelmed by the scaling needs for big data forensics that consider both post-mortem and real-time processing and visualization of evidence [2].
Customers need to analyze security event data in real time for internal and external threat management
Collect, store, analyze and report on log data for forensics and regulatory compliance, while maintaining the security and integrity of data.
[1] European Cybersecurity Industry Leaders. A report to M. Gunther H. Oettinger European, Commissioner for Digital Economy and Society. Recommendations on Cybersecurity for Europe
[2] Enterprise Strategy Group. Cybersecurity Analytics and Operations in Transition

4. Research challenges (1)
Growing size of heterogeneous data results in insufficient response time
Growing sophistication of malware and attackers highlights the need for developing post compromise and real-time forensics services
Need for advanced visualization methods to combine data from heterogeneous sources and to guide forensics investigators to identify areas warranting further review
Intuitive, detailed and user-centric visualizations capable of managing, analyzing and presenting in a user-friendly way large amount of forensics evidence.
Existing visualization frameworks drawbacks:
utilization of multiple tools is required
difficult to take information seen in one visualization tool and obtain a different perspective in another tool
many tools do not allow to import information from another tool.
significant amount of time to go through all of the tools, collect the data, and then create a coherent report that can potentially be used as evidence in the court of law.

5. Research challenges (2)
Better collection of effective data for post-incident security analysis
Current cyber-forensic methodologies are not always fully extensible to traditional control systems architectures
Correlation of forensic data collected by disparate cyber-centric security procedures and technologies (Firewalls [FW], Intrusion Detection Systems [IDS], Intrusion Prevention Systems, [IPS], etc.), with device and control systems logging data.
Post-incident analysis is often dependent on vendor involvement, and any proactive understanding of device logging is often not required by the end user or incorporated into a defence-in-depth strategy
Unforeseen interactions between the forensics tools and control systems
Inclusion of real-time forensics tools for active analysis
Increase in storage space on hard drives impacts both the performance utilization and the time when carrying out forensics tasks
Which brings us to visualization techniques.

6. Visualization Emphasis on visualization
Silver bullet for “active” (live) forensics?
Pros:
Provides good overview (situational awareness)
Allows combining data from different sources
Accommodates different views
Cons:
Clutter may confuse operator
Creating the views may cause delays
Worse, may lead the operator into wrong assumptions.

7. AEGIS Forensics Visualisation Toolkit
Intuitive, detailed and connected visualisations
CI-customised via CIPIs monitoring
Innovative Forensic Services
Timeline analysis
Preconfigured Views

8. Critical Infrastructure Performance Indicators
Key requirement is to define the Critical Infrastructure Performance Indicators (CIPIs) appropriate for the application.
Monitoring various CIPIs the forensics system can detect off-nominal behaviour. Examples include:
CPU load - Memory utilization
Disk size - disk usage  (e.g. free space per partition)
Number of current processes
Authentication event
Software installation - installation of new/fresh packages
ssh  login attempts (over a period of 1 hour)
concurrent ssh sessions > 0
concurrent http sessions > 1
Also non-CIPI data are collected, e.g. :   
Layer 2 connections (Ethernet)
Layer 3 connections (IP)
Running processes (name, cpu, memory, uid, etc)

9. Timeline Analysis
Event Analysis View allows to scroll forward or backward in time
Example:
Event occurs at time t0
Operator can use the timeline analysis tool to
see events that led to the event
compare current event with previous (similar) events
tool allows direct comparison of current with historical states.
as more data comes in, operator can investigate outcomes.

10. Timeline of CIPI Visualisations

11. Preconfigured views Event characterised by affected CIPIs
Benefit of AEGIS forensic toolkit is that “knowledge” gained during an analysis can be utilised in future similar incidents
Event characterised by affected CIPIs
Operator response is stored in the event file
Specific views brought up
Events selected – highlighted during analysis
Etc.
Actions can be collected in a “script” to be run when similar event is observed.
Benefits:
Speeds up incident response
Makes event reporting faster – easier
Allows operator to concentrate on the analysis rather than bringing up the required views.
Should be used only by experienced personnel
May lead operator to wrong analysis (fight the last battle).

12. Disk Analysis Acquire, Authenticate and Analyse data
Follow forensic tool guidelines
Keep chain of custody
FVT securely stores images of disk and offers visualisations of relevant CIPIs

13. Disk Analysis

14. Conclusions
Visualisation is crucial to active (live) Digital Forensics Analysis
The AEGIS visualisation toolkit is customised for the needs of Forensics Analysis for CIs
Key FVT Innovations
Critical Infrastructure Performance Indicators
Timeline Analysis
Preconfigured Views
Disk Analysis

15. Thank you Digital Forensics via AEGIS Visualization toolkit 16/10/2018
Leonidas Kallipolitis, AEGIS
The research leading to these results has received funding from the European Union’s Horizon 2020 Research and Innovation Programme, under Grant Agreement no