Forensic analysis

A Distributed Computing System comprising:

• a server computer system;
• and
• at least one client computer system;
• wherein the Distributed Computing System is configured to perform forensic analysis by collecting data in the at least one client computer system, the collected data being a system call to a resource comprised in the Distributed Computing System, the system call being collected by a collection tool, running on the at least one client computer system, from between a user space and a kernel space of the at least one client computer system;
• to filter the collected data to form a first data set, filtering comprising extracting file related system call data but not registry, process and memory related system call data;
• to apply a data reduction model to the first data set to form a second data set;
• and
• wherein the second data set is processed in the server computer system of the Distributed Computing System to provide for detection of suspect behaviour at the client computer system, in which the data reduction model is configured to extract a subset of data from the first data set to form the second data set, the subset of data comprising:
• a user account identifier;
• and a process and object identifier, the process and object identifier being one of:
• a process and physical resource identifier, and a process and logical object identifier.

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a Distributed Computer System including a client computer system and a server computer system, causes the Distributed Computer System to perform a method comprising:

• collecting data in the client computer system of the Distributed Computing System, the collected data being a system call to a resource comprised in the Distributed Computing System, the system call being collected by a collection tool from between a user space and a kernel space of the client computer system;
• filtering the collected data to form a first data set, filtering comprising extracting file related system call data but not registry, process and memory related system call data;
• applying a data reduction model to the first data set to form a second data set;
• and
• processing the second data set in the server computer system of the Distributed Computing System to provide for detection of suspect behaviour at the client computer system, in which
• the data reduction model is configured to extract a subset of data from the first data set to form the second data set, the subset of data comprising:
• a user account identifier;
• and a process and object identifier, the process and object identifier being one of:
• a process and physical resource identifier;
• and a process and logical object identifier.