search query: @keyword visualisointi / total: 80
reference: 19 / 80
« previous | next »
Author:Nisén, Patrik
Title:Implementation of a timeline analysis software for digital forensic investigations
Aikajanojen analysointiohjelmiston toteutus tietoturvapoikkeamien tutkintaan
Publication type:Master's thesis
Publication year:2013
Pages:77      Language:   eng
Department/School:Perustieteiden korkeakoulu
Main subject:Tietokoneverkot   (T-110)
Supervisor:Aura, Tuomas
Instructor:Nuopponen, Antti
Electronic version URL: http://urn.fi/URN:NBN:fi:aalto-201311217857
OEVS:
Electronic archive copy is available via Aalto Thesis Database.
Instructions

Reading digital theses in the closed network of the Aalto University Harald Herlin Learning Centre

In the closed network of Learning Centre you can read digital and digitized theses not available in the open network.

The Learning Centre contact details and opening hours: https://learningcentre.aalto.fi/en/harald-herlin-learning-centre/

You can read theses on the Learning Centre customer computers, which are available on all floors.

Logging on to the customer computers

  • Aalto University staff members log on to the customer computer using the Aalto username and password.
  • Other customers log on using a shared username and password.

Opening a thesis

  • On the desktop of the customer computers, you will find an icon titled:

    Aalto Thesis Database

  • Click on the icon to search for and open the thesis you are looking for from Aaltodoc database. You can find the thesis file by clicking the link on the OEV or OEVS field.

Reading the thesis

  • You can either print the thesis or read it on the customer computer screen.
  • You cannot save the thesis file on a flash drive or email it.
  • You cannot copy text or images from the file.
  • You cannot edit the file.

Printing the thesis

  • You can print the thesis for your personal study or research use.
  • Aalto University students and staff members may print black-and-white prints on the PrintingPoint devices when using the computer with personal Aalto username and password. Color printing is possible using the printer u90203-psc3, which is located near the customer service. Color printing is subject to a charge to Aalto University students and staff members.
  • Other customers can use the printer u90203-psc3. All printing is subject to a charge to non-University members.
Location:P1 Ark Aalto  6991   | Archive
Keywords:digital forensics
incident management
information security
databases
visualization
digitaalinen forensiikka
tietoturvapoikkeamien hallinta
tietoturva
tietokannat
visualisointi
Abstract (eng): Organizations today are trying to manage the many risks they percieve to be threatening the security of their valuable information assets, but often these risks realize into security incidents.
Managing risks proactively is important, but equally important and challenging is to efficiently respond to the incidents that have already occurred, to minimize their impact on business processes.

A part of managing security incidents is the technical analysis of any related computer systems, also known as digital forensic investigations.
As a result of collecting evidence such as log files from these systems, the analysts end up with large amounts of data, which can form a timeline of events.
These events describe different actions performed on the system in question.
Analysing the timelines to find any events of interest is challenging due to the vast amount of data available on modern systems.
The goal of this thesis is to create a software program to support the analysis of very large timelines as a part of digital forensic investigations.

As a result, we have implemented software with an efficient query interface, which supports iterative exploration of the data and more complex analytical queries.
Furthermore, we use a timeline visualization to compactly represent different properties of the data, which enables analysts to detect potential anomalies in an efficient way.
This software also serves as a platform for future work, to experiment with more automated analysis techniques.

We evaluated the software in a case study, in which it proved to show a great level of flexibility and performance compared to more traditional ways of working.
Abstract (fin): Tärkeä osa nykypäivän organisaatioiden riskienhallintaa on tietopääoman turvaamiseen liittyvien riskien tunnistaminen.
Näitä riskejä ei kuitenkaan usein oteta tarpeeksi vakavasti, sillä monesti ne myös realisoituvat tietoturvapoikkeamina.
Kattava etukäteisvalmistautuminen on tärkeää, mutta poikkeamien vaikutusten minimoimisen kannalta oleellista on myös valmius tehokkaaseen poikkeamatilanteiden hallintaan.

Osana tietoturvapoikkeamien hallintaa toteutetaan siihen liittyvien järjestelmien tekninen analyysi.
Todistusaineiston, kuten erilaisten lokitiedostojen, keruun tuloksena tutkijat muodostavat aikajanan järjestelmässä suoritetuista toiminnoista.
Koska modernien järjestelmien sisältämä tiedon määrä on poikkeuksetta suuri, on aikajanan analysointi mielenkiintoisten jälkien löytämiseksi erityisen haastavaa.
Tämän diplomityön tavoitteena onkin luoda ohjelmisto tukemaan kooltaan erityisen suurten aikajanojen analysointia.

Työn tuloksena luotiin ohjelmisto, joka tarjoaa tehokkaan kyselyrajapinnan, tukee tutkimukselle tyypillistä iteratiivista tiedon etsintää ja monimutkaisempia analyyttisia kyselyitä.
Lisaksi ohjelmisto mahdollistaa monipuolisen aikajanan visualisoimisen, mikä helpottaa huomattavasti käytöspoikkeamien löytämistä.
Tavoitteena oli myös tuottaa alusta, jota voidaan käyttää jatkossa uusien automaattisten analyysitekniikoiden kehittämisessä.

Ohjelmiston toimivuus todennettiin tapaustutkimuksessa, joka osoitti ohjelmiston olevan erityisen joustava ja suorituskykyinen verrattuna aikaisempiin toimintatapoihin.
ED:2013-04-03
INSSI record number: 46032
+ add basket
« previous | next »
INSSI