Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
(Microsoft, 2008). This caused the FileSystemWatcher to crash and it then failed to
capture any other events, until the application was restarted.
It had been suspected that the buffer overflow problem may have been caused by
either the size of the buffer, the HMAC tagging or the asymmetric encryption that was
happening after the events were captured; Figure 34 explains the process.
Figure 34: Data flow
Performance tests were then carried out on each of the individual components; this
initially consisted of increasing the size of the buffer, which made very little
difference when dealing with upwards of 5,000 events. A test was created that would
have the FileSystemWatcher capture events and send them directly to the TCP
Stream, thus bypassing the HMAC and Asymmetric Encryption. It had then been
noted that the previous buffer overflow problem had gone, even when the buffer size
was set back to its default value of 8K it still managed to successfully capture 20,000
events. After this successful test the HMAC tagging was added back in, this too did
not hinder the performance of the application, which left only the asymmetric
encryption process to be responsible.
6.3 Maintenance
Based upon the preliminary set of test results, the Event Logging Client and Server
applications were heavily modified to improve the encryption process. This involved
the use of symmetric encryption for handling the transfer of the events from the Client
to the Server. The shared key that the symmetric encryption uses is transferred from
the Client to the Server using asymmetric encryption.
This brings in several new stages for the Client Server Communication Protocol that
was originally described in the Design chapter. Figure 35 explains the new process:
52