Analysis and Evaluation of the Windows Event Log - Bill Buchanan

More documents

Recommendations

Info

Barrie Codona, BSc (Hons) Network Computing, 2007 100% 90% 80% Processor Load (%) 70% 60% 50% 40% 30% 20% 10% 0% Load 1 Core 1 3 5 7 9 12 14 17 19 21 23 26 28 30 32 35 37 39 41 44 46 48 50 53 55 57 60 62 64 67 Time (Seconds) Figure 43: Generating 10,000 files with symmetric encryption Processor Load (%) 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% 1 3 6 9 12 15 18 20 23 26 29 32 35 37 40 43 46 49 52 55 57 60 63 66 69 73 76 80 83 87 Load 1 Core Time (Seconds) Figure 44: Generating 20,000 files with symmetric encryption From these results it is also possible to calculate the amount of time it takes to produce these files using no encryption, symmetric encryption and asymmetric encryption. Figure 45 shows the comparison in the length of time it takes to encrypt events, with symmetric encryption, that are generated when files are created on a system. 57
Barrie Codona, BSc (Hons) Network Computing, 2007 80 70 60 50 Time Taken (Seconds) 40 30 20 10 0 1000 5000 10000 20000 Numer of Events No Encryption Symmetric Figure 45: Symmetric encryption comparison The above graph shows that it approximately takes 50% longer when using symmetric encryption as opposed to not encrypting anything. These results can then be compared to the length of time it takes using asymmetric encryption. Figure 46 compares the time taken to create the same files, but this time the events are encrypted with asymmetric encryption. 800 700 600 500 Time Taken 400 (Seconds) 300 200 100 0 1000 5000 10000 20000 Number of Events No Encryption Symmetric Asymmetric Figure 46: Asymmetric encryption comparison The above graph shows that using asymmetric encryption is approximately 8 times slower than symmetric encryption and 16 times slower than having no encryption at all. This justifies changing the project to use symmetric encryption for transferring the events to the data archiving system. 58
Page 1 and 2:
Analysis and Evaluation of the Wind
Page 3 and 4:
Barrie Codona, BSc (Hons) Network C
Page 5 and 6:
Barrie Codona, BSc (Hons) Network C
Page 7 and 8: Barrie Codona, BSc (Hons) Network C
Page 57: Barrie Codona, BSc (Hons) Network C
Page 75 and 76: Appendix A: Diary Sheets
Page 77 and 78: NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 85 and 86: Appendix B: Preliminary Gantt Chart
Page 87 and 88: Nov '07 Dec '07 Jan '08 Feb '08 Mar
Page 89 and 90: C:\Documents and Settings\Barrie\My
Page 95 and 96: Appendix D: Server Application Code
Page 99 and 100: Appendix E: Event Viewer Code
Page 105 and 106: Appendix G: Processor Monitor Code
Page 107 and 108: Appendix H: HMAC Brute Force Cracke
Page 109 and 110:
C:\Documents and Settings\Barrie\My
Page 111 and 112:
C:\Documents and Settings\Barrie\My
Page 113 and 114:
Appendix I: Windows Event Log Tests
Page 115 and 116:
Copy Security Log C:\windows\system
Page 117 and 118:
Another look at the Security Log re
Page 119 and 120:
The Event Service is then restarted
Page 121 and 122:
Another look at the ‘c:\windows\s
Page 123 and 124:
CO42019 - Project 4 Computer Name P
Page 125 and 126:
CO42019 - Project 4 Turned off the
Page 127 and 128:
CO42019 - Project 4 And then restar
Page 129 and 130:
CO42019 - Project 4 Modify the ‘l
Page 131 and 132:
CO42019 - Project 4 Project - Week
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
CO42019 - Project 4 As previously d
Page 139 and 140:
CO42019 - Project 4 The screenshot
Page 141 and 142:
CO42019 - Project 4 Displaying the
Page 143 and 144:
CO42019 - Project 4 Modifying the r
Page 145 and 146:
CO42019 - Project 4 Master File Tab
Page 147 and 148:
CO42019 - Project 4 Modify the sect
Page 149 and 150:
CO42019 - Project 4 Sectors 3748520
Page 151 and 152:
CO42019 - Project 4 This now shows
show all

Analysis and Evaluation of the Windows Event Log - Bill Buchanan

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?