Online Appendix to: Generalizing Database Forensics

Transcription

1 Online Appenix to: Generalizing Database Forensics KYRIACOS E. PAVLOU an RICHARD T. SNODGRASS, University of Arizona This appenix presents a step-by-step iscussion of the forensic analysis protocol that allows us to ientify many types of corruption events. A. THE FORENSIC ANALYSIS PROTOCOL Figures show ifferent parts of the formulation of the forensic analysis protocol (broken across four iagrams). We will iscuss Page Write Timestamp corruption (on isk), corruption, an Schema corruption using the the four figures as a guie. Data corruptions which affect an entire tuple will not be iscusse since no tools exist right now that aequately analyze these problems, even though we can etect that corruption is present. In general, the ientification of leaves for which no forensic tools exist (marke with Pening Future Work ) is part of our future work. After the section evote to the common starting path of the forensic protocol, each of the following sections correspons to the leaves of the above-liste major corruption subtypes. We emphasize that this protocol assumes a single corruption event. A iagram epicting the taxonomy an protocol together can be accesse at protocol.pf. The upper portion of the figures show portions of the UML taxonomy of corruption events (in shae rectangles). Everything appearing below the taxonomy epicts the steps taken an the tools use in the forensic analysis protocol, in orer to reach the leaves in the taxonomy. Within the lower position of the protocol are conitionals in iamons that enote questions istinguishing between variations of the same corruption subtype, irectives in (unshae) rectangles that inicate some computational task to be performe, an connectors in ellipses that connect the ifferent parts of the protocol using unique labels. Observables are the results of conitionals an of the forensic analysis algorithms. Recall that forensic analysis is a one-to-one corresponence between the observables an the elements in the taxonomy. Such a strong corresponence might not be possible to establish, either because of lack of tools (in this case the forensic analysis algorithms) or ue to the nature of the problem. Hence, we characterize forensic analysis as a mapping from observables to subsets of the taxonomy, which we term conclusion sets. Elements belonging to the same conclusion set are inistinguishable from one another given the available tools. Conclusion sets are shown in parallelograms. A legen in Figure 16 summarizes this useful information. The flow of analysis in the protocol is generally upwar, as inicate by the arrows. A.1. Initial Steps in Forensic Analysis Protocol Figure 16 shows that the protocol starts at the bottom of the iagram. The first question to be aske is whether the DBA has chosen a atabase scheme in which recors are physically clustere by their partition fiel. If the recors are clustere then in aition to the regular valiation proceure we must check the orer of recors uring the scan. This result will be useful later on in the protocol (vi. Figure 18). c 2013 ACM /2013/06-ART12 $15.00 DOI: ACM Transactions on Database Systems, Vol. 38,. 2, Article 12, Publication ate: June 2013.

2 App 2 K. E. Pavlou an R. T. Snograss Label B Explicit Label A Virtual (static numbere page partitioning) Which partition scheme is use? Implicit Label C True VE 0 False Label D False "DB is in a legal state." True VEn Perform valiation. : Forensic Analysis : Scheme Choice Perform Valiation while checking orer uring scan. Directive Recors physically clustere by partition fiel? UML class/subclass Output START Label X Connector to other figure with same label Fig. 16. Initial steps in forensic analysis protocol. ACM Transactions on Database Systems, Vol. 38,. 2, Article 12, Publication ate: June 2013.

3 Generalizing Database Forensics App 3 If the most recent Valiation Event returns true then the total hash chain has not been compromise. This implies that the atabase is not corrupte an it is in a legal state. If the Valiation Event returns false, meaning that the total chain has been corrupte, then we nee to ascertain whether this is ue to Schema corruption. This is achieve by valiating the notarize hash value corresponing to the atabase schema. If VE 0 is false, thus revealing schema corruption, we must follow Label D into Figure 19 to ientify the type of schema corruption. The iscussion for this can be foun in Section A.4. If VE 0 is true then no schema corruption has occurre. Before we can procee an execute the forensic analysis algorithm (in this case, the various types of a3d) we must choose the appropriate one base on the particular partitioning scheme use. Labels A, B, an C lea to the iscussion of use an results of the forensic analysis algorithm, for a Virtual (static-numbere pages), an Explicit (zip coe), or an Implicit (commit-time) partitioning scheme, respectively. The first label connects to Figure 17 with further iscussion foun in Section A.2, while the latter two connect to Figure 18 with further iscussion foun in Section A.3. As mentione earlier, espite running a forensic analysis algorithm we have no way of ascertaining whether an entire tuple on isk has been corrupte, that is, we o not yet have tools that coul istinguish it from other types of corruption. A.2. Corruption of Page Write Timestamps on Disk Figure 17 provies the portion of the protocol require for the ientification of corrupte Page Write Timestamps when these are store on isk as per the static-numbere pagebase partition scheme. Even though this is a type of corruption which occurs uner a Virtual partitioning scheme it oes not affect the partition attribute itself, namely the page number. In fact, in the case of static-numbere page-base partition scheme, the page number is not explicitly store anywhere an therefore cannot be corrupte. The algorithm can etermine the page number just by looking at what page the tuples resies in. A genuine Virtual corruption can occur in the nonstatic-numbere-page partitioning scheme but currently there are no tools to analyze such a corruption (vi. Section A.3 for more etails). After ascertaining that static-numbere page partition scheme is use (vi. Figure 16) we follow Label A into Figure 17. The Page-base a3d Forensic Analysis Algorithm is run, which coul yiel one or two resulting corruption regions. If a single corruption region is returne then we conclue that non-partition attribute has been corrupte. If two corruption regions are returne then a Page Write Timestamp resiing on a page on isk has been corrupte. Changing the timestamp will cause the associate ata to be hashe in the wrong orer uring the valiation scan. This causes the creation of two corruption regions: one correspons to the missing page (i.e., the position where the page ought to have been hashe) an the other to the new page (i.e., the position where the page is actually hashe). If the timestamp is change to later time the page will be hashe at a later stage in the valiation scan, while if it is change to an earlier time the page will be hash at an earlier stage. The former corruption is terme postating an the latter backating. Currently, we have no tools to istinguishing between the two types of corruption. (Physical clustering cannot help us here because we cannot cluster the pages by page write time since the same page albeit with ifferent contents is written out to isk multiple times.) We are force to resort to the backup tapes which will allow us to etermine the irection of corruption. (Even though there might be ways to fin the irection of timestamp corruption without making use of the backup tapes.) Discovering the original correct timestamp an comparing it with the corrupte one will allow us to ecie if the timestamp has been Backate or Postate. ACM Transactions on Database Systems, Vol. 38,. 2, Article 12, Publication ate: June 2013.

4 App 4 K. E. Pavlou an R. T. Snograss Data Corruption Page Write Timestamp NB: This is only for page base partitioning. Entire Tuple Backate Postate Partition n Partition Attr. Corrupte "to" before "from"? Determine "irection" of corruption. Compare backup tapes with ata. 2 How many regions oes the 1 Algorithm yiel? Run page base Variable Level a3d Forensic Algorithm. Label A VEn = False; VE0 = True ( schema corruption); Static Numbere Page base partitioning. Fig. 17. Forensic analysis protocol to ientify Page Write Timestamp corruption. ACM Transactions on Database Systems, Vol. 38,. 2, Article 12, Publication ate: June 2013.

5 Generalizing Database Forensics App 5 A.3. Corruption of Partition on Disk Figure 18 shows the portion of the forensic analysis protocol which allows for the ientification of the corruption event that affects partition attributes on isk; the attribute happens to be one that the ata are partitione on. This leas to three possibilities epening on the nature of the partition attribute, each with a ifferent forensic analysis technique applicable: Virtual attribute-base (non-static-numbere page-base), Explicit -base (what previous sections calle simply attribute-base), an Implicit attribute (commit-time-base). Page-base ata partitioning with non-statically numbere pages presents an interesting challenge. For example, in the case of τ BerkeleyDB [Snograss et al. 2004], the recors are store in the leaf noes of a B+-tree inex. The B+-tree invariant ictates that leaves must be at least half full, a fact which causes page splits. This results in recors migrating from the page they were originally store in an consequently in the page number of a specific recor changing over time. An effective forensic analysis algorithm for non-static-numbere page partitioning scheme has yet to be esigne. Following Label C into Figure 18 we first run Commit-time-base a3d Forensic Analysis Algorithm. We know we are partitioning on an Implicit (e.g., committime timestamps) so then next step is to check how many corruption regions the forensic analysis algorithm create. If it returne only one then we can safely say that the corruption affecte an attribute the ata are not partitione on. Elsewhere [Pavlou an Snograss 2008] this was terme a ata-only corruption an coul be either retroactive or introactive. If two corruption regions are prouce by the algorithm then this implies that an implicit attribute (timestamp) has been corrupte since a single corruption of a nonpartition attribute cannot yiel two corruption regions. w we must istinguish between a corruption which results in a backate timestamp an one which results in a postate timestamp. To achieve this we can impose a spatial organization on the atabase by exploiting the physical orer on the ata. Data can be store in contiguous segments of the isk in orer of commit time or of any attribute whose values/granules are naturally orere, for instance, age, transaction ID, page number, primary key, or accoring to any orer impose a hoc. This is essentially a heap where new recors are appene at the en. Let us consier a Backating CE. Backating is in effect the removal of a tuple from its original location on the isk an its subsequent introuction into a ifferent location. Changing only the timestamp, with no physical movement of the tuple, will rener the tuple to be out of orer, something that is evience of corruption. Therefore, to answer the to before from conitional we use the result of checking the orer of recors uring the Valiation scan (cf. initial steps of Figure 16). This is feasible because changing only the timestamp, with no physical movement of the tuple, will rener the tuple to be out of orer with respect to the impose physical orer, something which is evience of corruption. A tuple with an earlier timestamp than the timestamps of the proceeing tuples is evience of backating. Conversely, a tuple with a later timestamp than the timestamps of the succeeing tuples is evience of postating. If the ata are not physically clustere then we must compare the current ata with the ata in the backup tapes to etermine the irection of corruption. If the new value of the change implicit attribute (timestamp) refers to a time before the original value then we the corruption resulte in a backate timestamp. Otherwise, we have ientifie a postate timestamp. The path starting at Label B, to ientify a corruption uner an explicit attribute partitioning scheme, is very similar to that ealing with implicit attribute corruption. The only two ifferences are first, the nee to ientify which of the total chains ACM Transactions on Database Systems, Vol. 38,. 2, Article 12, Publication ate: June 2013.

6 App 6 K. E. Pavlou an R. T. Snograss Partition n Partition Attr. Corrupte Virtual Pening Future Work Explicit Implicit Change to lesser value Change to greater value Backate Postate Transaction ID Change NB: Artificial orer require for categorical attributes Pening Future Work "to" before "from"? "to" before "from"? Determine "irection" of corruption. Determine "irection" of corruption. Recors physically clustere by partition attr? Compare backup tapes with ata. Recors physically clustere by partition attr? Compare backup tapes with ata. 2 2 How many regions oes the Algorithm yiel? 1 How many regions oes the Algorithm yiel? 1 Ientify corrupte total chain(s). Run attribute base Variable Level a3d Forensic Algorithm. Run commit time base Variable Level a3d Forensic Algorithm. Label B VEn = False; VE0 = True ( schema corruption); base partitioning. Label C VEn = False; VE0 = True ( schema corruption); Commit time base partitioning. Fig. 18. Forensic analysis protocol to ientify Corruption. ACM Transactions on Database Systems, Vol. 38,. 2, Article 12, Publication ate: June 2013.

7 Generalizing Database Forensics App 7 Schema Corruption Table Schema Corrupte Column Schema Corrupte Other Schema Corrupte "Column" table "Table" table Detects ifferences in... Other schema table VE n = False VE 0 = True Label D Compare current contents of table metaata to backup. Fig. 19. Forensic analysis to ientify Schema Corruption. (if multiple are present) are the affecte ones an secon, the nee to have an artificial orer impose on the partitioning attribute (if it is categorical) when implementing the physical clustering of tuples on isk. Finally, note that for Virtual corruption to occur (an inee, corruption of any kin of attribute) the attribute values must themselves be susceptible to corruption. This is true in the case of non-static-numbere-page-base partitioning of the ata where the page number associate with a specific tuple changes with time. Therefore, the page number where the tuple was originally store in must be maintaine in some way. This reners these maintaine original page numbers susceptible to corruption. However, this is not an issue when the Virtual attribute we are partitioning on is static-numbere-pages. In this case the page numbers cannot be corrupte since they are not explicitly maintaine in any way. This is because at each point in time we know the page number associate with a specific tuple by virtue of looking at what page that tuple resies in. A.4. Forensic Analysis of Schema Corruption One of the issues left unaresse from earlier work in forensic analysis was how to eal with schema corruption. The initial iea was that before the atabase went online the schema of the atabase woul be hashe an notarize (NE 0 ). If uring forensic analysis the valiation of NE 0 prouce a false result then we woul know that the schema of the atabase has been compromise. As shown in Figure 19, we can eal with schema corruption by comparing the current contents of the metaata table to the backup. Depening on the etecte ifferences we can ientify a corruption to the Table or Column tables, or any other piece of metaata. ACM Transactions on Database Systems, Vol. 38,. 2, Article 12, Publication ate: June 2013.