Forensic Analysis of Database Tampering

1. Forensic Analysis of Database Tampering Kyriacos Pavlou and Richard T. Snodgrass Computer Science Department The University of Arizona

2. Introduction The problem : How to systematically perform forensic analysis on a compromised database. • Recent federal laws (HIPAA, Sarbanes-Oxley Act etc.) and incidents of corporate collusion mandateaudit log security. • Snodgrass et al. [VLDB04] showed how to detect database tampering. Approach: Hashusing a cryptographically strong hash function, notarize data manipulated by transactions and periodically validate. • Forensic analysis to ascertain: • When the intrusion transpired • What data was altered • Who the intruder is • Why has this transpired

3. Outline • Tamper Detection • Forensic Analysis • The corruption diagram • Types of corruption events • Forensic Algorithms • Three algorithms • Forensic strength • Future Work

4. Tamper Detection transactions transactions hash value hash value transactions transactions notary ID notary ID + + hashing hashing hash value + notary ID result rehash • Two phases: • Normal Processing • Validation • The validation result is a single bit.

5. The Corruption Diagram . INnotarization interval validation interval IV CE When Actual time VE2 VE2 = TRUE NE6 NE: Notarization Event NE5 clock time VE: Validation Event NE4 CE: Corruption Event = TRUE VE1 NE3 link NE2 link NE1 Commit time commit time NE0 Where

6. Forensic Analysis • If a corruption is detected, the forensic analyzer springs into action. • The analyzer tries to ascertain a corruption region: the bounds on the uncertainty of the “where” and “when” of the corruption.

7. Monochromatic Algorithm T F F F F . CE When Forensic analysis begins VE2 = FALSE NE6 NE5 time of corruption (tc) NE4 VE1 = TRUE NE3 Corruption Region: captures the uncertainty as to the position of CE NE2 NE1 tl: place of corruption(commit time) NE0 Where

8. Monochromatic Algorithm • Central insight: data can be rehashed by validator and checked. • Corruption region bounds: IV IN • Area is solely dependent on the two intervals. • Cannot handle CEs involving timestamp corruption. ×

9. The RGB Forensic Algorithm G B . CE T F F F F F F Postdating CE G B tp: postdating time tp T When F VE4 = FALSE NE8 Forensic analysis begins IV= 4 days IN= 2 days tc NE7 T Notarization of Red R VE3 = TRUE NE6 NE5 T Notarization ofBlue&Green VE2 = TRUE NE4 NE3 Notarization of Red R VE1 = TRUE NE2 NE1 x x tl NE0 Where

10. The RGB Forensic Algorithm • Introduction of RGB partial hash chains: • Allows the bounding of both tl and tp • Incurs extra NS cost • Each of two corruption regions bounds: IV IN • We would like to reduce the area of the corruption regions. ×

11. The Polychromatic Algorithm G B . CE T F F F F F F G B F T When F VE4 = FALSE NE8 Forensic analysis begins IV= 4 days IN= 2 days Desired = 1 day tc NE7 T Notarization of 2 Reds R VE3 = TRUE NE6 NE5 T Backdating CE F F Notarization of2Blues&1Green VE2 = TRUE NE4 Uncertainty can be arbitrarily shrunk via a logarithmic number of red and blue hash chains. NE3 Notarization of 2 Reds R VE1 = TRUE NE2 NE1 tb: backdating time x x tl tb NE0

12. Forensic Strength Components: • Work of forensic analysis • Region-area of CE • Width of postdating / backdating uncertainty Inverse Forensic Strength: IFS( D , IN ,V ) = ( NumNotarizes( D , IN ,V ) + ForensicAnalysis( D , IN ,V ) ) · RegionArea( IN ,V ) · UncertaintyWidth( D , IN) where V = IV / IN is the validation factor and D is the number of days before first validation failure. • Monochromatic: O( V · D2· IN ) • RGB: O( V · D · IN2 ) We assume that D >> IN . • Polychromatic: O( ( V + lg IN ) · D )

13. Future Work • Develop a stronger lower bound for this problem. • Accommodate multi-locus and complexCEs. • Differentiate postdating and backdatingCEs. • Implement forensic analysis in validator. • Consider interaction between transaction-time storage manager and underlying WORM storage.

14. Summary • We have presented a means of performing forensic analysis. • We have introduced a graphical representation to visualize CEs, termed the corruption diagram. • We have designed three forensic algorithms. • Monochromatic • RGB • Polychromatic