SYSTEMS AND METHODS FOR CORRECTING TIMESTAMPS ON DATA RECEIVED FROM UNTRUSTED DEVICES

摘要

Aspects of the technology include receiving (202) an event log of events, each that are associated with wall clock and uptime clock timestamps, and extracting (204) a currently analyzed event from the event log. Further, aspects include associating (208) a processor time to the currently analyzed event as a trusted event time if the event is the first event. Aspects include calculating (212) an elapsed time from wall clock times associated with an immediately preceding event and the currently analyzed event where the immediately preceding event is a boot log event. Further aspects can include calculating (214) the elapsed time from uptime clock times associated with the immediately preceding event and the currently analyzed event where the immediately preceding event is not a boot log event. Finally, aspects can include calculating (216) a trusted time by deducting the elapsed time from a trusted event time.

主权项

1. A computer-implemented method comprising:
receiving, by a processor and from a computing device, an event log, the event log comprising data representing a plurality of events, each event associated with a wall clock time and an uptime clock time; extracting, by the processor and from the event log, a currently analyzed event, the currently analyzed event including a wall clock time and an uptime clock time associated with the currently analyzed event; and responsive to determining, by the processor, that no event in the event log immediately precedes the currently analyzed event, associating a processor time to the currently analyzed event as a trusted event time.