File access activity information is an important source for identifying unauthorized data transmissions. In this paper, we present a semantic approach for the monitoring of le system activity in the context of information security. We thereby tackle limitations of existing monitoring approaches in terms of semantic integration, contextualization, and cross-system interoperability. In particular, we present a vocabulary for le activity logs and outline an architecture for log le collection, extraction, linking, and storage. We demonstrate the applicability of this approach by means of an application scenario. Finally, we show how analysts can inspect the life-cycle of les in a context-rich manner by means of SPARQL queries and a graph visualization of the results.
Safeguarding the con dentiality and integrity of sensitive data is an increasingly
di cult challenge that organizations face today. Data breaches can have a severe
negative impact on the reputation, trustworthiness, and revenues of the a ected
companies, and also harm their customers and business partners. In the face of
increasing data volumes and digitization, data ex ltration has become a critical
concern [
Once a data breach has occurred, a key prerequisite for an appropriate
response is an understanding of its scope and impact. To this end, digital forensic
methods are often applied to trace attack steps and determine the data a ected.
In this context, examiners often face the task of identifying data that has been
copied to a removable storage device, uploaded to a user's personal cloud storage,
or otherwise transmitted outside the physical or electronic walls of the
organization to which the data belongs [
In this paper, we introduce a novel approach that leverages semantic web technologies to address these challenges. This approach has the potential to harmonize heterogeneous le activity information across various operating systems and logs, and facilitates contextualization through interlinking with relevant information and background knowledge.
To this end, we developed (i) a set of vocabularies for the uniform representation of le system log entries, which we introduce in Section 2; (ii) an architecture for le system log acquisition, le event extraction, and interlinking, covered in Section 3; and (iii) mechanisms that allow analysts to trace the life-cycle of les in a context-rich manner via a SPARQL query interface and a graph visualization, which we will illustrate by means of an example in Section 4. 2
Operating systems typically provide information about le system activity, i.e., clues when given les are being created, deleted, modi ed, renamed, copied, etc. Both Windows and Linux/Unix provide such information by logging multiple micro-operations. For instance, a single delete operation is commonly preceded by a sequence of operations such as handle requests and object access attempts. Consequently, these systems typically log several low-level (e.g., kernel) events that jointly indicate an event such as the copying of a le.
We collect le system activity data from heterogeneous le system logs (e.g.,
Windows event log, Linux audit log) and leverage a semantic model to
harmonize them. Semantic representations provide machine-readability and facilitate
interlinking between multiple log data formats, e.g., to trace the history of a le
across systems. We organize our semantic model into two levels, i.e., log entry
level and le operation level. As mentioned above, a single extracted log entry
is typically not su cient to represent a le operation event, therefore, we need
to aggregate them and generate high level representations for le access events.
For the log entry model, we extended a previously developed vocabulary [
To model le operations, we chose a bottom-up approach, inspecting existing le activity logs and extracting the relevant concepts and terms. As depicted in Figure 1, the introduced le operation vocabulary5 describes the concept of le access events (fae:FileAccessEvent) and a set of properties. The property fae:hasAction re ects the type of access taken to the le (e.g., create, modify, copy, rename, move, delete). The property fae:hasUser links the le event to the user accessing the le; fae:hasProgram represents the executable used to 4 https://w3id.org/sepses/vocab/log/win-event,
vocab/log/unix-event 5 https://w3id.org/sepses/vocab/event/file-access https://w3id.org/sepses/ access the le, and fae:timestamp captures the time of the access. The properties fae:hasSourceFile and fae:hasTargetFile model the relation between an original le and a new le or location after the event. Furthermore, property fae:hasSourceHost and fae:hasTargetHost represent the hosts where the source and target les are located. 3
6 https://www.elastic.co/products/beats/filebeat 7 https://www.elastic.co/products/logstash 8 https://json-ld.org/ 9 https://github.com/kabulkurniawan/fileAccessExtractor 10 https://w3id.org/sepses/example/system-knowledge 11 We use Virtuoso in our prototypical implementation. 12 https://w3id.org/sepses/sparqlplus } 4
PREFIX fae: <http://w3id.org/sepses/vocab/event/file-access#> PREFIX cl: <http://w3id.org/sepses/vocab/log/core#> SELECT distinct ?time ?sourceFile ?action ?targetFile ?user ?host ?ipaddress WHERE { ?y fae:timestamp ?time. ?y fae:hasAction/fae:actionName ?action. ?y fae:hasUser/fae:userName ?user. ?y fae:hasSourceFile/fae:pathName ?sourceFile. ?y fae:hasTargetFile/fae:pathName ?targetFile. ?y fae:hasTargetHost ?h. ?h cl:hostName ?host. ?h cl:IPAddress ?ipaddress. ?x fae:hasSourceFile/fae:fileName "wordpad.rtf" . ?x fae:relatedTo* ?y .
ORDER BY ASC(?time)
Listing 1: File Access Monitoring
To illustrate the approach, we implemented an application scenario for le system monitoring, involving a Windows 8 and Ubuntu 18.04 le server and a folder with les we want to monitor. To simulate user activity, we implemented a batch le to trigger certain le access operations. The generated log data was shipped to the log extractor, automatically parsed, extracted, and nally stored in the triple store (cf. Section 3). With this data store, a security analyst can analyze the life-cycle of a certain le by means of SPARQL queries (cf. Listing 1). Starting from the lename (e.g., wordpad.rtf, we want to query all related le events (sequentially), including the timestamp, type of action, user, hostname, etc. Table 1 shows a query result for this example.
Figure 2 displays a visual representation of the result data, which makes it easier to follow the sequence of actions. As we can see, on the Windows system, User1 renamed the le, then copied it to a Dropbox folder (Dropboxnwordpad ren.rtf ), and nally, moved the original le to the recycle bin. Due to Dropbox synchronization, the le wordpad ren.rtf was created on the Linux server as well. Subsequently, the Linux user User2 moved the document to the folder UserDoc and from this location copied the le to a removable media (/Volumes/USER2 ). Finally, this user deleted the original le from his folder. In an interactive model, the analyst could display additional information from the vocabulary (e.g., the timestamps) for further inspection.
Time SourceFile Action TargetFile User Host IPAddress 16:34:16 C:n..wordpad.rtf created User1 Win8 192.168.1.2 16:34:38 C:n..wordpad.rtf renamed C:n..wordpad ren.rtf User1 Win8 192.168.1.2 16:35:10 C:n..wordpad ren.rtf copied C:n..Dropboxnwordpad ren.rtf User1 Win8 192.168.1.2 16:35:10 C:n..wordpad ren.rtf deleted C:n..Recycle.Binn..GHH.rtf User1 Win8 192.168.1.2 16:36:12 /User2/Dropbox/wor..ren.rtf created User2 Ubuntu 192.168.1.3 18:03:24 /User2/Dropbox/wor..ren.rtf moved /User2/UserDoc/wor..ren.rtf User2 Ubuntu 192.168.1.3 18:04:25 /User2/UserDoc/w..ren.rtf copied /Volumes/USER2/w..ren.rtf User2 Ubuntu 192.168.1.3 18:06:06 /User2/UserDoc/w..ren.rtf deleted /User2/.Trash/w..ren.rtf User2 Ubuntu 192.168.1.3
In this paper, we introduced a semantic approach to understand le events and their change history. We thereby tackle the lack of interoperability of existing le monitoring solutions to support security analysts, e.g., in detecting the ex ltration of sensitive data. Our framework collects le activity logs from heterogeneous sources, integrates and semantically enriches the information with background knowledge, and stores the results as RDF triples. We developed a vocabulary to uniformly represent the le system log entries and a prototype implementation of the solution concept. Furthermore, we demonstrated the applicability of the approach by means of an application scenario, simulating user-triggered le activity on a Windows and Linux system. Finally, we present a SPARQL query to trace the life-cycle of a le and present a graph visualization to support understanding.
Based on this work in progress, we will extend and optimize the prototype and the interactive visualization for analysts, and conduct an extensive evaluation of the approach. To this end, we will develop additional scenarios and extend our testing environment to support complex, multi-system scenarios. Another future research direction is to investigate the potential of stream reasoning engines for continuous monitoring of security-relevant le system activities as well as the use of Ontology-Based Data Access (OBDA) methods for large-scale log monitoring.