digital-forensics-labs/digital-forensics-lab
1
0
Fork 0
mirror of https://github.com/frankwxu/digital-forensics-lab.git synced 2026-04-10 12:13:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

add stix

Browse Source
This commit is contained in:
Frank Xu
2021-01-31 11:15:00 -05:00
parent a29472e9b3
commit 353ffdfa62
1 changed files with 3 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
STIX_for_digital_forensics/readme.md
View File

@@ -1,40 +1,10 @@
# STIX for Digital Forensics
The goal of the project is to extend STIX™ to (1) facilitate the sharing of Cyber Forensic Intelligence (CFI) (2) building the foundations for automated digital forensic investigations.
The goal of the project is to explore and build an extended STIX™ (xSTIX), to exchange Cyber Forensic Intelligence (CFI). While STIX focuses on understanding, responding to, and mitigating computer-based attacks, the xSTIX allows cyber forensics communities to better understand what and how digital evidence is left on hosts and networks during these attacks and to reconstruct digital forensic-based crime scenes after attacks.
The major extension of STIX for the goal is Digital Forensic Objects (DFO). DFO are events generated and recorded by firmware, drivers, operating systems, and software applications. These recorded events are often used to meet functional needs or non-functional requirements. For example, the Windows security feature requires logging all security-related activities for auditing. Google driver records all files status for a faster local and remote files synchronization.
The xSTIX includes a set of Cyber Forensic Objects (CFO)s. CFOs are CFI domain objects that are corresponding to concepts used in hosts and networks but are more intensively used for CFI, e.g., the concepts of file and webpage visits. Each CFO represents an event generated and recorded by firmware, drivers, operating systems, and software applications. The recorded event is often used to meet functional or non-functional requirements of a feature/system. For example, the Windows security feature requires logging all security-related activities for auditing; Google drive records all files' status for a faster local and remote files synchronization. CFOs are different from STIX Cyber-Observable Data objects because CFOs are pre-processed data in the context of CFI instead of raw data that Cyber-observable Objects want to describe.
Distinguish from STIX™ Objects
- Different from STIX™ Cyber-observable Objects: Digital Forensic Objects are pre-processed data instead of raw data that Cyber-observable Objects want to describe.
- Extension of STIX™ Domain Objects: Digital Forensic Objects correspond to concepts used in hosts and networks but are more intensively used for cyber investigations.
The extension details include:
- Create a list of DFOs. We follow the STIX specification for [customizing objects](https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html#_p2sz1mp7z524). The most important rule to create a new object type is that the value of the type property in a Custom Object SHOULD start with “x-” followed by a source unique identifier (like a domain name with dots replaced by hyphens), a hyphen and then the name. For example, x-example-com-customobject.
- property extension for Windows™ Registry Key Object. We focus on extending the data property of registry value as the data may contain rich information that needs to be organized and formalized as digital evidence. The pattern of the extension is shown below. Note that the string **"x_data"** is assigned to **"data"** (e.g., **"data": "x_data"**) as a place holder and **x_data:[]** is the extended property that contains formalized information of data.
```json
{
"type": "windows-registry-key",
"spec_version": "2.1",
"id": "windows-registry-key--2ba37ae7-2745-5082-9dfd-9486dad41016",
"key": "hkey_local_machine\\system\\bar\\foo",
"values": [
{
"name": "Foo",
"data": "x_data",
"data_type": "REG_BINARY"
}
],
"x_data": [
{
"type": "x-extended-type",
"id": "x-extended-type--83aee86d-1523-4111-938e-8edc8a6c804f"
}
]
}
```
We follow the STIX specification for [customizing objects](https://docs.oasis-open.org/cti/stix/v2.1/cs01/stix-v2.1-cs01.html#_p2sz1mp7z524). The most important rule to create a new object type is that the value of the type property in a Custom Object SHOULD start with “x-” followed by a source unique identifier (like a domain name with dots replaced by hyphens), a hyphen and then the name. For example, x-example-com-customobject.
---