System and method for generating and storing forensics-specific metadata

Patent metadata

Field	Value
Publication number	US-11601443-B2
Application number	US-201916582497-A
Country	US
Kind code	B2
Filing date	Sep 25, 2019
Priority date	Sep 25, 2019
Publication date	Mar 7, 2023
Grant date	Mar 7, 2023

Abstract

Disclosed herein are systems and method for generating and storing forensics-specific metadata. In one aspect, a digital forensics module is configured to generate a backup of user data stored on a computing device in accordance with a backup schedule. The digital forensics module identifies, from a plurality of system metadata of the computing device, forensics-specific metadata of the computing device based on predetermined rules, wherein the forensics-specific metadata is utilized for detecting suspicious digital activity. The digital forensics module generates a backup of the forensics-specific metadata in accordance with the backup schedule and analyzes the forensics-specific metadata for an indication of the suspicious digital activity on the computing device. In response to detecting the suspicious digital activity based on the analysis, generates a security event indicating that the suspicious digital activity has occurred.

First claim

The invention claimed is:

1. A method for storing forensics-specific metadata, the method comprising:
generating a backup of user data stored on a computing device in accordance with a backup schedule;
identifying, from a plurality of system metadata of the computing device, forensics-specific metadata of the computing device based on predetermined rules, wherein the forensics-specific metadata is utilized for detecting suspicious digital activity;
generating a backup of the forensics-specific metadata in accordance with the backup schedule, wherein the backup of the forensics-specific metadata is stored separately from the backup of the user data;
analyzing the forensics-specific metadata for an indication of the suspicious digital activity on the computing device;
in response to detecting the suspicious digital activity based on the analysis, generating a security event indicating that the suspicious digital activity has occurred and increase the frequency of the backup schedule;
identifying characteristics of the suspicious digital activity;
identifying enhanced forensics-specific metadata based on the characteristics, wherein the enhanced forensics-specific metadata comprises characteristic-specific details of the suspicious digital activity;
performing at least one additional iteration of generating another backup of the enhanced forensics-specific metadata in accordance with the backup schedule; and
analyzing the enhanced forensics-specific metadata for additional information about the suspicious digital activity on the computing device to generate subsequent security events.

2. The method of claim 1 , wherein generating the security event further comprises marking subsequent user data backups of the backup schedule as potentially affected by the suspicious digital activity.

3. The method of claim 1 , wherein generating the security event further comprises requesting that a digital investigation be performed.

4. The method of claim 1 , wherein generating the security event further comprises restoring the computing device with a previous backup of the user data generated prior to the suspicious digital activity.

5. The method of claim 1 , wherein generating the security event further comprises increasing a frequency of generating backups in the backup schedule of the forensics-specific metadata.

6. The method of claim 1 , wherein the forensics-specific metadata comprises at least one of:
an identifier of a running process,
memory allocation information,
an identifier of a running thread,
security privilege information,
registry information,
an identifier of a hidden process, and
an auto-run path on the computing device.

7. The method of claim 1 , further comprising:
generating a notarization identifier of the backup of the forensics-specific metadata, wherein the notarization identifier is one of: a blockchain transaction identifier, a hash value, a digital signature, or a checksum; and
storing the notarization identifier with the backup of the forensics-specific metadata.

8. The method of claim 1 , wherein analyzing the forensics-specific metadata for the indication of the suspicious digital activity comprises:
identifying a first backup of the forensics-specific metadata generated at a first time and a second backup of the forensics-specific metadata generated at a second time after the first time;
detecting, from the forensics-specific metadata, a process in the second backup that is not present in the first backup; and
determining whether the process is trusted; and
in response to determining that the process is not trusted, detecting the indication of the suspicious digital activity on the computing device.

9. The method of claim 8 , wherein determining whether the process is trusted comprises:
comparing the process to a plurality of known trusted processes listed in a data structure; and
determining that no match between the process and a known trusted process in the plurality of known trusted processes exists.

10. A system for storing forensics-specific metadata, the system comprising:
a hardware processor configured to:
generate a backup of user data stored on a computing device in accordance with a backup schedule;
identify, from a plurality of system metadata of the computing device, forensics-specific metadata of the computing device based on predetermined rules, wherein the forensics-specific metadata is utilized for detecting suspicious digital activity;
generate a backup of the forensics-specific metadata in accordance with the backup schedule, wherein the backup of the forensics-specific metadata is stored separately from the backup of the user data;
analyze the forensics-specific metadata for an indication of the suspicious digital activity on the computing device;
in response to detecting the suspicious digital activity based on the analysis, generate a security event indicating that the suspicious digital activity has occurred and increase the frequency of the backup schedule;
identify characteristics of the suspicious digital activity;
identify enhanced forensics-specific metadata based on the characteristics, wherein the enhanced forensics-specific metadata comprises characteristic-specific details of the suspicious digital activity;
perform at least one additional iteration of generating another backup of the enhanced forensics-specific metadata in accordance with the backup schedule; and
analyze the enhanced forensics-specific metadata for additional information about the suspicious digital activity on the computing device to generate subsequent security events.

11. The system of claim 10 , wherein the hardware processor is further configured to generate the security event by marking subsequent user data backups of the backup schedule as potentially affected by the suspicious digital activity.

12. The system of claim 10 , wherein the hardware processor is further configured to generate the security event by requesting that a digital investigation be performed.

13. The system of claim 10 , wherein the hardware processor is further configured to generate the security event by restoring the computing device with a previous backup of the user data generated prior to the suspicious digital activity.

14. The system of claim 10 , wherein the hardware processor is further configured to generate the security event by increasing a frequency of generating backups in the backup schedule of the forensics-specific metadata.

15. The system of claim 10 , wherein the hardware processor is further configured to:
generate a notarization identifier of the backup of the forensics-specific metadata, wherein the notarization identifier is one of: a blockchain transaction identifier, a hash value, a digital signature, or a checksum; and
store the notarization identifier with the backup of the forensics-specific metadata.

16. The system of claim 10 , wherein the hardware processor is further configured to analyze the forensics-specific metadata for the indication of the suspicious digital activity by:
identifying a first backup of the forensics-specific metadata generated at a first time and a second backup of the forensics-specific metadata generated at a second time after the first time;
detecting, from the forensics-specific metadata, a process in the second backup that is not present in the first backup; and
determining whether the process is trusted; and
in response to determining that the process is not trusted, detecting the indication of the suspicious digital activity on the computing device.

17. The system o

Assignees

• Acronis Int Gmbh

Inventors

• Strogov Vladimir
• Ishanov Oleg
• Dod Alexey
• Beloussov Serguei
• Protasov Stanislav

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F11/1451 Primary

  by selection of backup contents · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/562 Primary

  Static detection · CPC title

• G06F11/1469

  Backup restoration techniques · CPC title