What is an Analysis Pipeline?

Brief overview of Analysis Pipeline
The traditional security industry is mainly focused on matching signatures which proved to be a not sufficient method anymore. Every piece of evidence needs to be investigated carefully and the DRONE investigation analysis process is based on the Analysis Pipeline method.
The method works in a way that every property of evidence is investigated as a whole. DRONE is composed of analysis pipelines and every piece of evidence is passed through a pipeline check that is specifically designed for analyzing and understanding the nature of that evidence. Each pipeline analyses a specific attribute of that evidence, and in this way, every process or file that is passed through the investigation pipeline will be pushed out from the pipeline as a finding with an assigned score.
Verdict Categories Definition:
  • Dangerous - provided automatically by DRONE
  • Matched - if a specific keyword is provided, DRONE will tag those findings as matched
  • Suspicious- findings that are marked as suspicious warns the analyst to pay high attention to them
  • Relevant - findings that analysts should pay attention to them since they are marked as relevant to the investigation
  • Rare - findings that are not dangerous or suspicious but may be of interest to the investigation
If DRONE cannot put a verdict on a finding, then it will still score the evidence based on its attributes.