Patent Document ID: 8887274
Application ID: 13063003
Patent Status: 1

Claim One:
1. A digital forensic analysis method performed in a processor, the method comprising the steps of: collecting historical system call data from a digital computing system (DCS), the historical system call data corresponding to a plurality of system calls which comprise system calls corresponding to suspicious activity performed on the DCS; converting the collected historical system call data to form a historical sequence comprising a string of sequence elements in which each system call is represented as solely one sequence element; selecting from a system call sequence database a test sequence comprising a string of sequence elements in which each sequence element represents a system call, wherein the system calls represented in the test sequence correspond to the suspicious activity performed on the DCS, the system calls which correspond to the suspicious activity being represented by suspicious activity sequence elements that are non-contiguous in at least one of the historical sequence and the test sequence; and applying, via a computing, processor, a non-contiguous sequence alignment algorithm to the historical sequence and the test sequence during a post-event sequence matching process, the non-contiguous sequence alignment algorithm being operative to match the suspicious activity sequence elements of the historical sequence with the suspicious activity sequence elements of the test sequence to thereby detect suspicious activity reflected in the historical system call data collected from the DCS, wherein the non-contiguous sequence alignment algorithm is operative to identify a longest sequence of suspicious activity sequence elements common to the historical sequence and the test sequence, and wherein applying a non-contiguous sequence alignment algorithm comprises use of a biological sequence matching algorithm.