Due to the increasing number and impact of computer security incidents, it has become essential to develop and implement efficient measures for their investigation. However, comprehensive forensic analyses are time-consuming, and this time is often not available to security analysts during computer security incidents. As a result, automated tools are increasingly being used. These tools, however, often cover only a limited scope of the necessary analyses and typically require deep technical expertise to be used effectively.
This work presents the PYRAMID framework (Python YAML-based Response & Analysis for Malware & Incident Detection). The PYRAMID framework enables automated Incident Analysis (IA) of hard drive disk images in the context of computer security incidents and aims to automatically identify whether a system has been compromised. For this purpose, a workflow was designed to control the execution of 14 integrated analysis tools to reproduce the manual analysis process usually performed by analysts. The framework is structured in a modular way, with each module representing a specific analytical aspect. This architecture supports flexible extension and adaptation to new requirements.
To evaluate the framework, tests were conducted using both compromised and non-compromised disk images. The results demonstrate that the PYRAMID Framework is capable of identifying compromised systems, successfully detecting all 2 truly compromised images out of a total of 6 analyzed disk images. However, a significant number of false positive classifications were also observed. Nevertheless, the framework effectively narrows large datasets to relevant artifacts, since on average only 0.19 % of all files per image needed to be analyzed to determine whether a system was compromised.