KIPS Transactions on Computer and Communication Systems (정보처리학회논문지:컴퓨터 및 통신 시스템)

Korea Information Processing Society (한국정보처리학회)
권호 표지
DOI QR코드

DOI QR Code

Digital Forensic Investigation of HBase

HBase에 대한 디지털 포렌식 조사 기법 연구

  • 박아란 (고려대학교 정보보호대학원 정보보호학과) ;
  • 정두원 (고려대학교 정보보호대학원 정보보호학과) ;
  • 이상진 (고려대학교 정보보호대학원)
  • Received : 2016.11.01
  • Accepted : 2016.11.22
  • Published : 2017.02.28
Download PDF
⟨ Previous Next ⟩

Abstract

As the technology in smart device is growing and Social Network Services(SNS) are becoming more common, the data which is difficult to be processed by existing RDBMS are increasing. As a result of this, NoSQL databases are getting popular as an alternative for processing massive and unstructured data generated in real time. The demand for the technique of digital investigation of NoSQL databases is increasing as the businesses introducing NoSQL database in their system are increasing, although the technique of digital investigation of databases has been researched centered on RDMBS. New techniques of digital forensic investigation are needed as NoSQL Database has no schema to normalize and the storage method differs depending on the type of database and operation environment. Research on document-based database of NoSQL has been done but it is not applicable as itself to other types of NoSQL Database. Therefore, the way of operation and data model, grasp of operation environment, collection and analysis of artifacts and recovery technique of deleted data in HBase which is a NoSQL column-based database are presented in this paper. Also the proposed technique of digital forensic investigation to HBase is verified by an experimental scenario.

최근 스마트 기기의 발전과 소셜 네트워크 서비스(SNS)의 대중화로 기존 관계형 데이터베이스(RDBMS)에서는 처리하기 어려운 데이터들이 증가하고 있다. 이러한 대용량의 비정형 데이터를 실시간으로 처리하기 위한 대안으로 비관계형 데이터베이스(NoSQL DBMS)가 각광 받고 있다. 데이터베이스 디지털 포렌식 조사 기법은 대부분 관계형 데이터베이스를 대상으로 연구되어왔으나, 최근 NoSQL DBMS를 도입하는 기업이 증가하면서 NoSQL DBMS에 대한 디지털 포렌식 기법의 수요도 증가하고 있다. NoSQL DBMS는 정규화할 스키마가 존재하지 않고, 데이터베이스 종류나 운영환경에 따라 저장방식이 상이하기 때문에 디지털 포렌식 조사 시 이를 고려한 새로운 기법들이 필요하다. NoSQL DBMS 중 문서형 데이터베이스에 대한 연구는 진행되어 왔지만, 이를 다른 종류의 NoSQL DBMS에 그대로 적용하기엔 한계가 있다. 이에 본 논문에서는 NoSQL DBMS 중 컬럼형 데이터베이스인 HBase의 구동 방식과 데이터 모델을 소개하고, 운영환경 파악과 아티팩트 수집 및 분석, 삭제된 데이터의 복구 방안에 대해 제안하여 이를 바탕으로 HBase에 대한 디지털 포렌식 조사 기법에 대해 연구하였다. 또한 실험 시나리오를 통해 제안된 HBase에 대한 디지털 포렌식 조사 기법을 검증한다.

Keywords

References

  1. R. Cattell, "Scalable SQL and NoSQL data stores," Acm Sigmod Record, Vol. 39, No. 4, pp. 12-27, 2011. https://doi.org/10.1145/1978915.1978919
  2. B. Choi, J. H. Kong, S. S. Hong, and M. M. Han, "The Method of Analyzing Firewall Log Data using MapReduce based on NoSQL," Journal of the Korea Institute of Information Security and Cryptology, Vol. 23, No. 4, pp. 667-677, 2013. https://doi.org/10.13089/JKIISC.2013.23.4.667
  3. J. S. Lee and S. C. Hong, "Study on the Application Methods of Big Data at a Corporation," Journal of the Korea Institute of Information Security and Cryptology, Vol. 15, No. 1, pp. 103-112, 2014.
  4. H. K. Khanuja, and D. S. Adane, "A Framework For Database Forensic Analysis," Computer Science & Engineering: An International Journal (CSEIJ), Vol. 2, No. 3, 2012.
  5. A. Aldhaqm, S. A. Razak, S. H. Othman, A. Ali, and A. Ngadi, "Conceptual Investigation Process Model for Managing Database Forensic Investigation Knowledge," Sciences, Engineering and Technology, Vol. 12, No. 4, pp. 386-394, 2016.
  6. K. E. Pavlou, and R. T. Snodgrass, "Forensic Analysis of Database Tampering," ACM Transactions on Database Systems (TODS), Vol. 33, Iss.4, pp. 1-45, 2008.
  7. J. H. Choi, D. W. Jeong, and S. J. Lee, "The method of recovery for deleted record in Oracle Database," Journal of The Korea Institute of Information Security & Cryptology(JKIISC), Vol. 23, No. 5, pp. 947-955, 2013. https://doi.org/10.13089/JKIISC.2013.23.5.947
  8. O. M. Adedayo and M. S. Olivier, "Ideal log setting for database forensics reconstruction," Digital Investigation, Vol. 12, pp. 27-40, 2015. https://doi.org/10.1016/j.diin.2014.12.002
  9. J. S. Yoon, D. W. Jung, C. H. Kang, and S. J. Lee, "Digital Forensic Investigation of MongoDB," Journal of the Korea Institute of Information Security and Cryptology, Vol. 24, No. 1, pp. 123-134, 2014. https://doi.org/10.13089/JKIISC.2014.24.1.123
  10. J. M. Choi, D. W. Jung, J. S. Yoon, and S. J. Lee, "Digital Forensics Investigation of Redis Database," KIPS Transactions on Computer and Communication Systems, Vol. 5, No. 5, pp. 117-126, 2016. https://doi.org/10.3745/KTCCS.2016.5.5.117
  11. F. C., J. Dean, S. Ghemawat, W. C. Hsieh, D. A. Wallach, M. Burrows, T. Chandra, A. Fikes, and R. E. Gruber, "Bigtable: A Distributed Storage System for Structured Data," Transactions on Computer Systems (TOCS), Vol. 26 Iss.2, pp. 205-218, 2008.
  12. G. Xiaoming, and Q. Judy, "Scalable inverted indexing on NoSQL table storage," Technical Report, Jan., 2013.
  13. S. W. Seo, Hadoop & NoSQL for analyzing and processing big data, in Gilbut, p.401.
  14. T. Harter, D. Borthakur, S. Dong, A. Aiyer, L. Tang, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau, "Analysis of hdfs under hbase: A facebook messages case study," in Proceedings of the 12th USENIX Conference on File and Storage Technologies (FAST 14), pp. 199-212, 2014.
  15. Hadoop Commands [Internet], https://hadoop.apache.org/docs/r2.4.1/hadoop-project-dist/hadoop-common/FileSystemShell.html.
  16. D. C. Lee, and S. J. Lee, "Research of organized data extraction method for digital investigation in relational database system," Journal of the Korea Institute of Information Security and Cryptology, Vol. 22, No. 3, pp. 565-573 (9 pages), 2012.
  17. A. B. M. Moniruzzaman and S. A. Hossain, "NoSQL Database: New Era of Databases for Big data Analytics-Classification, Characteristics and Comparison," International Journal of Database Theory and Application, Vol. 6, No. 4. pp. 1-13, 2013.
  18. J. S. Yoon, D. W. Jung, C. H. Kang, and S. J. Lee, "Forensic investigation framework for the document store NoSQL DBMS: MongoDB as a case study," Digital Investigation, Vol. 17, pp. 53-65, 2016. https://doi.org/10.1016/j.diin.2016.03.003
  19. G. Harrison, "Data Models and Storage," Next Generation Databases, pp. 145-166, 2015.
  20. L. George, "HBase : The Definitive Guide, O'Reilly Media, Inc.," pp. 333-334, 2011.
  21. H. Zhuang, K. Lu, C. Li, M. Sun, H. Chen, and X. Zhou, "Design of A More Scalable Database System," IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing, pp. 1213-1216, 2015.