Loading patent…
AssigneeInternational Business Machines Corporation
InventorsFrederico Araujo, Anne E. Kohlbrenner, Marc Philippe Stoecklin, Teryl Paul Taylor
Estimating the term…
A stackable filesystem that transparently tracks process file writes for forensic analysis. The filesystem comprises a base filesystem, and an overlay filesystem. Processes see the union of the upper and lower filesystems, but process writes are only reflected in the overlay. By providing per-process views of the filesystem using this stackable approach, a forensic analyzer can record a process's file-based activity—i.e., file creation, deletion, modification. These activities are then analyzed to identify indicators of compromise (IoCs). These indicators are then fed into a forensics analysis engine, which then quickly decides whether a subject (e.g., process, user) is malicious. If so, the system takes some proactive action to alert a proper authority, to quarantine the potential attack, or to provide other remediation. The approach enables forensic analysis without requiring file access mediation, or conducting system event-level collection and analysis, making it a lightweight, and non-intrusive solution.
A method of forensic analysis in a filesystem comprising filesystem overlays deployed on top of a writable base filesystem, comprising:
An apparatus, comprising:
A computer program product in a non-transitory computer readable medium, the computer program product holding computer program instructions to provide forensic analysis in a filesystem comprising filesystem overlays deployed on top of a writable base filesystem, the computer program instructions comprising program code configured to:
Dependencies are inferred from the claim text.