View source for Detecting Threatening Insiders with Lightweight Media Forensics

This research uses machine learning and outlier analysis to detect potentially hostile insiders through the auto
mated analysis of stored data on cell phones, laptops, and desktop computers belonging to members of an organization. Whereas other systems look for specific signatures associated with hostile
insider activity, our system is based on the creation of a “storage profile” for each user and then an automated analysis of all the storage profiles in the organization, with the purpose of finding
storage outliers. 

Our hypothesis is that malicious insiders will have specific data and concentrations of data that differ from their colleagues and coworkers. By exploiting these differences, we can identify potentially hostile insiders.

Our system is based on a combination of existing open source computer forensic tools and datamining algorithms. We modify these tools to perform a “lightweight” analysis based on statistical sampling over time. In this, our approach is both efficient and privacy sensitive. As a result, we can detect not just individuals that differ from their co-workers, but also insiders that differ from their historic norms. Accordingly, we should be able to detect insiders that have been “turned” by events or outside organizations. We should also be able to detect insider accounts that have been taken over by outsiders.

==Project Status==
Our project, now in its second year, is a three-year project funded by the Department of Homeland Security, Science and Technology Directorate, Cyber Security Division.

==Publications and Presentations==
# Garfinkel, Simson, Nicole Beebe, Lishu Liu, and Michele Maasberg, [http://simson.net/clips/academic/2013.IEEE-HST.Insider.pdf Detecting Threatening Insiders with Lightweight Media Forensics] [http://simson.net/ref/2013/2013-11-13_IEEE_HST.pdf (slides)], IEEE Technologies for Homeland Security (HST 2013), Nov 12-14, Waltham, MA. 2013
# Beebe, N.L.; Maddox, L.A.; Lishu Liu; Minghe Sun, [http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6567922 "Sceadan: Using Concatenated N-Gram Vectors for Improved File and Data Type Classification,"] Information Forensics and Security, IEEE Transactions on , vol.8, no.9, pp.1519,1530, Sept. 2013
# Beebe, Nicole, [http://www.dfrws.org/2012/proceedings/DFRWS2012-challenge-winner.pdf SCEADAN v1.0: Systematic Classification Engine and Data ANalysis], DFRWS 2012 Challenge Winner, June 2012

==Technology==
Our system is based in part on:

* [https://github.com/simsong/bulk_extractor bulk_extractor], a high-speed feature extractor
* [http://code.google.com/p/grr/ grr] (Google's Rapid Response), an Incident Response Framework
* [https://github.com/nbeebe/sceadan SCEADAN], Systematic Classification Engine And Data ANalysis, a file fragment type classifier

==Team==
; PIs
* [http://simson.net/ Simson Garfinkel], Associate Professor, Naval Postgraduate School, Arlington, VA
* [http://faculty.business.utsa.edu/nbeebe/ Nicole Beebe], Assistant Professor, University of Texas at San Antonio
; Staff
* [https://www.linkedin.com/in/lishuliu Lishu Liu], Research Software Developer, The University of Texas at San Antonio

==Acknowledgements and Disclaimers==
* This publication results from research supported by the Naval Postgraduate School Assistance Grant/Agreement No. N00244-13-1-0027 awarded by the NAVSUP Fleet Logistics Center San Diego (NAVSUP FLC San Diego). The views expressed in written materials or publications, and/or made by speakers, moderators, and presenters, do not necessarily reflect the official policies of the Naval Postgraduate School nor does mention of trade names, commercial practices, or organizations imply endorsement by the U.S. Government.
* This material is based on research sponsored by the Department of Homeland Security (DHS) Science and Technology Directorate, Homeland Security Advanced Research Projects Agency, Cyber Security Division (DHS S&T/HSARPA/CSD) via BAA 11-02, and the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).
* The views expressed in this work are those of the authors and do not necessarily reflect the official policy or position of the Naval Postgraduate School; the Department of the Navy; the Department of Defense; the Department of Homeland Security; the U.S. Government; or the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).

__NOTOC__