Detecting Threatening Insiders with Lightweight Media Forensics - Revision history

Simson at 15:41, 1 July 2014

2014-07-01T15:41:24Z

← Older revision		Revision as of 08:41, 1 July 2014
Line 9:		Line 9:

	We currently have:		We currently have:
	* A working lightweight agent that runs on Windows, Mac, and Linux systems. The agent is delivered a ~~Python2~~.7 egg that includes the bulk_extractor shared library compiled for each platform.		* A working lightweight agent that runs on Windows, Mac, and Linux systems. The agent is delivered a Python3.4 egg that includes the bulk_extractor shared library compiled for each platform.
	* A lightweight server that collects reports from the agent.		* A lightweight server that collects reports from the agent.
	* Initial algorithms for outlier detection based on temporal and spatial anomalies.		* Initial algorithms for outlier detection based on temporal and spatial anomalies.

Simson: /* Project Status */

2014-06-16T19:03:45Z

Project Status

← Older revision		Revision as of 12:03, 16 June 2014
Line 7:		Line 7:
	==Project Status==		==Project Status==
	Our project, now in its second year, is a three-year project funded by the Department of Homeland Security, Science and Technology Directorate, Cyber Security Division.		Our project, now in its second year, is a three-year project funded by the Department of Homeland Security, Science and Technology Directorate, Cyber Security Division.

			We currently have:
			* A working lightweight agent that runs on Windows, Mac, and Linux systems. The agent is delivered a Python2.7 egg that includes the bulk_extractor shared library compiled for each platform.
			* A lightweight server that collects reports from the agent.
			* Initial algorithms for outlier detection based on temporal and spatial anomalies.

			We are looking for:
			* Organizations who would be interested in deploying our test agent and collector on a small network of between 10 and 100 machines.
			* Researchers within those organizations that would like to work on data visualization and outlier detection algorithms.

	==Publications and Presentations==		==Publications and Presentations==

Simson: /* Team */

2014-06-16T18:58:20Z

Team

← Older revision		Revision as of 11:58, 16 June 2014
Line 23:		Line 23:
	* [http://simson.net/ Simson Garfinkel], Associate Professor, Naval Postgraduate School, Arlington, VA		* [http://simson.net/ Simson Garfinkel], Associate Professor, Naval Postgraduate School, Arlington, VA
	* [http://faculty.business.utsa.edu/nbeebe/ Nicole Beebe], Assistant Professor, University of Texas at San Antonio		* [http://faculty.business.utsa.edu/nbeebe/ Nicole Beebe], Assistant Professor, University of Texas at San Antonio
	~~; Staff~~
	* [https://www.linkedin.com/in/lishuliu Lishu Liu], Research Software Developer, The University of Texas at San Antonio

	==Acknowledgements and Disclaimers==		==Acknowledgements and Disclaimers==

Simson: /* Technology */

2014-06-16T18:57:57Z

Technology

← Older revision		Revision as of 11:57, 16 June 2014
Line 17:		Line 17:

	* [https://github.com/simsong/bulk_extractor bulk_extractor], a high-speed feature extractor		* [https://github.com/simsong/bulk_extractor bulk_extractor], a high-speed feature extractor
	* [http://code.google.com/p/grr/ grr] (Google's Rapid Response), an Incident Response Framework
	* [https://github.com/nbeebe/sceadan SCEADAN], Systematic Classification Engine And Data ANalysis, a file fragment type classifier		* [https://github.com/nbeebe/sceadan SCEADAN], Systematic Classification Engine And Data ANalysis, a file fragment type classifier

Simson at 12:02, 7 April 2014

2014-04-07T12:02:38Z

← Older revision		Revision as of 05:02, 7 April 2014
Line 1:		Line 1:
	This research uses machine learning and outlier analysis to detect potentially hostile insiders through the ~~auto~~		This research uses machine learning and outlier analysis to detect potentially hostile insiders through the automated analysis of stored data on cell phones, laptops, and desktop computers belonging to members of an organization. Whereas other systems look for specific signatures associated with hostile insider activity, our system is based on the creation of a “storage profile” for each user and then an automated analysis of all the storage profiles in the organization, with the purpose of finding storage outliers.
	~~mated~~ analysis of stored data on cell phones, laptops, and desktop computers belonging to members of an organization. Whereas other systems look for specific signatures associated with hostile
	insider activity, our system is based on the creation of a “storage profile” for each user and then an automated analysis of all the storage profiles in the organization, with the purpose of finding
	storage outliers.

	Our hypothesis is that malicious insiders will have specific data and concentrations of data that differ from their colleagues and coworkers. By exploiting these differences, we can identify potentially hostile insiders.		Our hypothesis is that malicious insiders will have specific data and concentrations of data that differ from their colleagues and coworkers. By exploiting these differences, we can identify potentially hostile insiders.

Simson at 21:47, 6 April 2014

2014-04-06T21:47:24Z

← Older revision		Revision as of 14:47, 6 April 2014
Line 34:		Line 34:
	* This material is based on research sponsored by the Department of Homeland Security (DHS) Science and Technology Directorate, Homeland Security Advanced Research Projects Agency, Cyber Security Division (DHS S&T/HSARPA/CSD) via BAA 11-02, and the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).		* This material is based on research sponsored by the Department of Homeland Security (DHS) Science and Technology Directorate, Homeland Security Advanced Research Projects Agency, Cyber Security Division (DHS S&T/HSARPA/CSD) via BAA 11-02, and the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).
	* The views expressed in this work are those of the authors and do not necessarily reflect the official policy or position of the Naval Postgraduate School; the Department of the Navy; the Department of Defense; the Department of Homeland Security; the U.S. Government; or the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).		* The views expressed in this work are those of the authors and do not necessarily reflect the official policy or position of the Naval Postgraduate School; the Department of the Navy; the Department of Defense; the Department of Homeland Security; the U.S. Government; or the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).

			__NOTOC__

Simson: /* Disclaimer */

2014-04-06T17:05:44Z

Disclaimer

← Older revision		Revision as of 10:05, 6 April 2014
Line 30:		Line 30:
	* [https://www.linkedin.com/in/lishuliu Lishu Liu], Research Software Developer, The University of Texas at San Antonio		* [https://www.linkedin.com/in/lishuliu Lishu Liu], Research Software Developer, The University of Texas at San Antonio

	==~~Disclaimer~~==		==Acknowledgements and Disclaimers==
	This material is based on research sponsored by the Department of Homeland Security (DHS) Science and Technology Directorate, Homeland Security Advanced Research Projects Agency, Cyber Security Division (DHS S&T/HSARPA/CSD) via BAA 11-02, and the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).		* This publication results from research supported by the Naval Postgraduate School Assistance Grant/Agreement No. N00244-13-1-0027 awarded by the NAVSUP Fleet Logistics Center San Diego (NAVSUP FLC San Diego). The views expressed in written materials or publications, and/or made by speakers, moderators, and presenters, do not necessarily reflect the official policies of the Naval Postgraduate School nor does mention of trade names, commercial practices, or organizations imply endorsement by the U.S. Government.
			* This material is based on research sponsored by the Department of Homeland Security (DHS) Science and Technology Directorate, Homeland Security Advanced Research Projects Agency, Cyber Security Division (DHS S&T/HSARPA/CSD) via BAA 11-02, and the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).
	The views expressed in this work are those of the authors and do not necessarily reflect the official policy or position of the Naval Postgraduate School; the Department of the Navy; the Department of Defense; the Department of Homeland Security; the U.S. Government; or the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).		* The views expressed in this work are those of the authors and do not necessarily reflect the official policy or position of the Naval Postgraduate School; the Department of the Navy; the Department of Defense; the Department of Homeland Security; the U.S. Government; or the Department of National Defence of Canada, Defence Research and Development Canada (DRDC).

Simson: /* Technology */

2014-04-06T17:03:36Z

Technology

← Older revision		Revision as of 10:03, 6 April 2014
Line 21:		Line 21:
	* [https://github.com/simsong/bulk_extractor bulk_extractor], a high-speed feature extractor		* [https://github.com/simsong/bulk_extractor bulk_extractor], a high-speed feature extractor
	* [http://code.google.com/p/grr/ grr] (Google's Rapid Response), an Incident Response Framework		* [http://code.google.com/p/grr/ grr] (Google's Rapid Response), an Incident Response Framework
			* [https://github.com/nbeebe/sceadan SCEADAN], Systematic Classification Engine And Data ANalysis, a file fragment type classifier

	==Team==		==Team==

Simson: /* Publications and Presentations */

2014-04-06T17:02:48Z

Publications and Presentations

← Older revision		Revision as of 10:02, 6 April 2014
Line 14:		Line 14:
	# Garfinkel, Simson, Nicole Beebe, Lishu Liu, and Michele Maasberg, [http://simson.net/clips/academic/2013.IEEE-HST.Insider.pdf Detecting Threatening Insiders with Lightweight Media Forensics] [http://simson.net/ref/2013/2013-11-13_IEEE_HST.pdf (slides)], IEEE Technologies for Homeland Security (HST 2013), Nov 12-14, Waltham, MA. 2013		# Garfinkel, Simson, Nicole Beebe, Lishu Liu, and Michele Maasberg, [http://simson.net/clips/academic/2013.IEEE-HST.Insider.pdf Detecting Threatening Insiders with Lightweight Media Forensics] [http://simson.net/ref/2013/2013-11-13_IEEE_HST.pdf (slides)], IEEE Technologies for Homeland Security (HST 2013), Nov 12-14, Waltham, MA. 2013
	# Beebe, N.L.; Maddox, L.A.; Lishu Liu; Minghe Sun, [http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6567922 "Sceadan: Using Concatenated N-Gram Vectors for Improved File and Data Type Classification,"] Information Forensics and Security, IEEE Transactions on , vol.8, no.9, pp.1519,1530, Sept. 2013		# Beebe, N.L.; Maddox, L.A.; Lishu Liu; Minghe Sun, [http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6567922 "Sceadan: Using Concatenated N-Gram Vectors for Improved File and Data Type Classification,"] Information Forensics and Security, IEEE Transactions on , vol.8, no.9, pp.1519,1530, Sept. 2013
	# Beebe, Nicole, [http://www.dfrws.org/2012/proceedings/DFRWS2012-challenge-winner.pdf SCEADAN		# Beebe, Nicole, [http://www.dfrws.org/2012/proceedings/DFRWS2012-challenge-winner.pdf SCEADAN v1.0: Systematic Classification Engine and Data ANalysis], DFRWS 2012 Challenge Winner, June 2012
	v1.0: Systematic Classification Engine and Data ANalysis], DFRWS 2012 Challenge Winner, June 2012

	==Technology==		==Technology==

Simson at 17:02, 6 April 2014

2014-04-06T17:02:32Z

← Older revision		Revision as of 10:02, 6 April 2014
Line 11:		Line 11:
	Our project, now in its second year, is a three-year project funded by the Department of Homeland Security, Science and Technology Directorate, Cyber Security Division.		Our project, now in its second year, is a three-year project funded by the Department of Homeland Security, Science and Technology Directorate, Cyber Security Division.

	==Publications==		==Publications and Presentations==
	# Garfinkel, Simson, Nicole Beebe, Lishu Liu, and Michele Maasberg, [http://simson.net/clips/academic/2013.IEEE-HST.Insider.pdf Detecting Threatening Insiders with Lightweight Media Forensics] [http://simson.net/ref/2013/2013-11-13_IEEE_HST.pdf (slides)], IEEE Technologies for Homeland Security (HST 2013), Nov 12-14, Waltham, MA. 2013		# Garfinkel, Simson, Nicole Beebe, Lishu Liu, and Michele Maasberg, [http://simson.net/clips/academic/2013.IEEE-HST.Insider.pdf Detecting Threatening Insiders with Lightweight Media Forensics] [http://simson.net/ref/2013/2013-11-13_IEEE_HST.pdf (slides)], IEEE Technologies for Homeland Security (HST 2013), Nov 12-14, Waltham, MA. 2013
			# Beebe, N.L.; Maddox, L.A.; Lishu Liu; Minghe Sun, [http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=6567922 "Sceadan: Using Concatenated N-Gram Vectors for Improved File and Data Type Classification,"] Information Forensics and Security, IEEE Transactions on , vol.8, no.9, pp.1519,1530, Sept. 2013
			# Beebe, Nicole, [http://www.dfrws.org/2012/proceedings/DFRWS2012-challenge-winner.pdf SCEADAN
			v1.0: Systematic Classification Engine and Data ANalysis], DFRWS 2012 Challenge Winner, June 2012

	==Technology==		==Technology==
Line 19:		Line 22:
	* [https://github.com/simsong/bulk_extractor bulk_extractor], a high-speed feature extractor		* [https://github.com/simsong/bulk_extractor bulk_extractor], a high-speed feature extractor
	* [http://code.google.com/p/grr/ grr] (Google's Rapid Response), an Incident Response Framework		* [http://code.google.com/p/grr/ grr] (Google's Rapid Response), an Incident Response Framework

			==Team==
			; PIs
			* [http://simson.net/ Simson Garfinkel], Associate Professor, Naval Postgraduate School, Arlington, VA
			* [http://faculty.business.utsa.edu/nbeebe/ Nicole Beebe], Assistant Professor, University of Texas at San Antonio
			; Staff
			* [https://www.linkedin.com/in/lishuliu Lishu Liu], Research Software Developer, The University of Texas at San Antonio

	==Disclaimer==		==Disclaimer==