Select a timekeeper.
09-Apr-97 Meeting Notes
Attendees: Steven Templeton, Chris, Julie, Brant, Karl, Raymond
Notes taken by Julie Lang
Meeting began @ 6:10pm and ended @ 7:30pm
Milestones
Framework for on-line analysis of NT audit
Brant wrote program to read contents of audit log.
Need to implement filtering, maybe use query tool (MS
Access)
pattern recognition, Crystal Report Writer
Auditing of NT based objects
Brant has researched a little.
Can they be used to detect misuse? Requires further
investigation.
Id std app programs thru auditing
Use dlls to determine if user is behaving normally.
No research done yet.
Experiment with opening apps and checking audit log.
Report summarizing TOF NT 3.51
` Steven has looked at it. C2 certification only
applicable to the exact OS and system that was evaluated.
We will all look through and make notes on what is useful.
Code and documentation for creating on-line analyzer
See number 1
NT auditing tool
See number 2
Report on characterization of misuse with emphasis on
malicious accesses????
Determine std events NT File system logs
Done
Brainstorm examples of misuse relative to some policies
Will be doing soon
NT security login suitable for misuse detection?
Ongoing. Events logged better than Unix.
Static Analysis of program with respect to telltale signs.
Currently on detection of polymorphic viruses.
Ongoing.
Raymond Lo's thesis.
Changed direction, no longer applicable
Specification approach
Ongoing.
Macro Viruses
Ongoing. Research and considering applicability of
polymorphic virus. Is the source code always available?
More high level info available.
Java/Activex
Eliminated by sponsors.
Analyzing currently available detection methods
Ongoing. Need to install on NT machine and test. Use
zip drive.
Talk to Rick Crawford, Mark Dilger.
Abstractions for Event Records
Chris and Brant started. Need to write up. Will
continue working.
Internal Auditors
SIS - key data, major concern is that data can be corrupted.
Grades, etc.
Banner - general database - payroll, inventory.
They will give us access to any and all data associated with
the University, including UCDMC and VMTH. If not online
system then static snapshot.
Chris will meet with David on Friday to discuss his master's
thesis on fraud in financial aid.
Agenda for Next Week
N-gram
Medical Misuse talk
Internal Auditors
Mentee - Industrial Espionage, writing macro viruses - virus
that does n-gram document recognition