Abstract:Recently, APT attacks have frequently happened, which are increasingly complicated and more challenging for traditional security detection models. The system logs are vital for cyber security analysis mainly due to their effective reconstruction ability of system behavior. existing log collection tools built on ETW for Windows suffer from working shortages, including data loss, high overhead, and weak real-time performance. Therefore, It is still very difficult to apply ETW-based Windows tools to analyze APT attack scenarios. To address these challenges, this paper proposes an efficient and lossless kernel log collector called Kellect, which has open sourced with project at <a class="link-external link-http" href="http://www.kellect.org" rel="external noopener nofollow">this http URL</a>. It takes extra CPU usage with only 2%-3% and about 40MB memory consumption, by dynamically optimizing the number of cache and processing threads through a multi-level cache solution. By replacing the TDH library with a sliding pointer, Kellect enhances analysis performance, achieving at least 9 times the efficiency of existing tools. Furthermore, Kellect improves compatibility with different OS versions. Additionally, Kellect enhances log semantics understanding by maintaining event mappings and application callstacks which provide more comprehensive characteristics for security behavior analysis. With plenty of experiments, Kellect demonstrates its capability to achieve non-destructive, real-time and full collection of kernel log data generated from events with a comprehensive efficiency of 9 times greater than existing tools. As a killer illustration to show how Kellect can work for APT, full data logs have been collected as a dataset Kellect4APT, generated by implementing TTPs from the latest ATT&CK. To our knowledge, it is the first open benchmark dataset representing ATT&CK technique-specific behaviors, which could be highly expected to improve more extensive research on APT study.

Automated Event Log File Recovery Based on Content Characters and Internal Structure

A Survey of Digital Passive Lossless Forensics on Forged and Altered Document

Kellect: a Kernel-Based Efficient and Lossless Event Log Collector for Windows Security

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

FLAP: An End-to-End Event Log Analysis Platform for System Management

A Method to Automatically Filter Log Evidences for Intrusion Forensics

Efficiently Cleaning Structured Event Logs: A Graph Repair Approach

Data Correlation-Based Analysis Methods for Automatic Memory Forensic

A Survey on Automated Log Analysis for Reliability Engineering

An Intelligent Framework for Log Anomaly Detection Based on Log Template Extraction

Automated Analysis of Multi-Source Logs for Network Forensics

Recovery of Heavily Fragmented JPEG Files

A New Approach to Multimedia Files Carving

A reference database of Windows artifacts for file-wiping tool execution analysis

An Efficient Heuristic Method for Repairing Event Logs Independent of Process Models

AutoLog: facing log redundancy and insufficiency

General, Efficient, and Real-Time Data Compaction Strategy for APT Forensic Analysis

Holistic Processing and Exploring Event Logs

NEGAR: Network Embedding Guided Architecture Recovery for Software Systems

Event log anomaly detection method based on auto-encoder and control flow

Design and Implementation of a Data Parsing Module for Power Information Equipment Log Management System