“Instant replay” quickly pinpoints cyberattack details
In addition to its selectivity in recording events, RAIN creates a multi-level review capability that is coarse at first, then more detailed when specific events of interest are identified. Timing of the activities – the inputs, environment and resulting actions – are also synchronized to help investigators understand a complex sequence of activities.
“During the replay of an event, we use binary dynamic instrumentation tools to do the extraction of the appropriate information,” said Taesoo Kim, an assistant professor in Georgia Tech’s School of Computer Science and one of the paper’s co-authors. “We organize information in a hierarchical way, and for each level apply a different type of automated analysis. At the deepest layer, we can tell what happened at the byte level.”
The hierarchical approach allows still more flexibility in how the analysis is done after an attack.
“These fine-grained analyses, which can be extremely useful when investigating an attack, would be too expensive to perform on a deployed system; but our hierarchical approach allows us to run these analysis off-line, and only when necessary,” said Alessandro Orso, associate chair of Georgia Tech’s School of Computer Science and another co-author.
Even with RAIN’s selectivity, storing the relevant information requires significant capacity, but the advent of inexpensive storage makes that practical, said Kim. For instance, an average desktop computer might generate four gigabytes of system data per day, less than two terabytes per year. That amount of storage can now be purchased for as little as $50 per year.
“I think we are getting into an affordable range of storage cost,” Kim said.
Assessing the damage done by intruders now often takes weeks or months. Beyond accelerating that process, RAIN could help the operators of high-value military or commercial computer networks continually improve their security by providing a level of visibility that is impossible today, Lee said.
“When this is deployed, organizations can have complete transparency, or visibility, about what went wrong,” he explained. “The operators of any network housing important data would want to have something like this to replace a manual process with a much more precise and automated technique.”
The research team is in the third year of a four-year project funded by DARPA. Additional improvements are being made to the system with a goal of transitioning it to industry.
“This would likely become an independent system that does the logging and interface for other security systems to understand what has happened,” Lee explained. “This could be the first product that actually logs the necessary information to reconstruct, or replay, and analyze events that have happened on a computer system, for the first time enabling automated forensics.”
— Read more in these summaries of Georgia Tech research being presented at the 2017 ACM Conference on Computer and Communications Security.
