If we employ a forensic agent/multi-agent to gather digital forensic data "potential" across diverse platforms, we all know that, this data will be streaming from different platforms. So if this is true, How can we solve the problem of Time synchronization across the different platforms if all agents in the machines are synchronized within the same time zone
*Take note: If we have to normalize based on attributes.
I am curious, is there any issue you see with using NTP (second link below) for your hosts/VMs? I have used NTP synchronized hosts in a project that gathered log data from multiple hosts around the world and sent them to a SaaS logging service for analysis, including looking for port scans. I describe the process briefly in the paper at the first link below. While that paper focuses on anonymization and web site performance analysis, it does describe our logging architecture which you could probably reuse for security purposes and goes over some security oriented work we did at the same time. NTP worked fine for me because I didn't need much better than a second accuracy.
Although NTP is useful, my experience is that you still have to check input time stamps for being drastically out of sync. This is important in any distributed application. In the paper described in the third link below, although we were using hosts that were supposed to be NTP synchronized, occasionally NTP synchronization would fail and drastically out of sync time stamps on data would really cause problems for our analysis (section 4.3.1 in the paper). We ended up looking at all incoming data time stamps and not using data from hosts with clocks that were off.
http://support.ntp.org/bin/view/Main/WebHome
Article Enhancing Cloud Security Using Data Anonymization
Conference Paper Implementing and operating an internet scale distributed app...
@ Jeff,
Thanks for these, this sounds more relevant to what i was asking.
Hello Victor,
In addition to NTP,you shall also make the systems to sync the date with google servers.This is also applicable if your application is distributed in different geographical locations.
- Badges
- Science method