%0 Conference Proceedings
%T Insider Threat Detection Using Time-Series-Based Raw Disk Forensic Analysis
%+ The University of Texas at San Antonio (UTSA)
%A Beebe, Nicole
%A Liu, Lishu
%A Ye, Zi
%Z Part 4: Threat Detection and Mitigation
%< avec comité de lecture
%( IFIP Advances in Information and Communication Technology
%B 13th IFIP International Conference on Digital Forensics (DigitalForensics)
%C Orlando, FL, United States
%Y Gilbert Peterson
%Y Sujeet Shenoi
%I Springer International Publishing
%3 Advances in Digital Forensics XIII
%V AICT-511
%P 149-167
%8 2017-01-30
%D 2017
%R 10.1007/978-3-319-67208-3_9
%K Insider threat
%K Anomaly detection
%K Time series
%K Profiling
%Z Computer Science [cs]Conference papers
%X This research tests the theory that volitional, malicious computer use based on insider threat activity can be detected via a time-series-based analysis of data and file type forensic artifacts that reside on a raw disk. In other words, statistical profiling of allocated and unallocated space pertaining to the types of files accessed and the data browsed, acquired and processed incident to espionage, intellectual property theft, fraud or organizational computer abuse can help detect insider threats. The t-test approach is used to compare the means of two time windows using the split and sliding window methods along with first-order autoregressive modeling. Empirical testing against the nineteen-day snapshots of the M57-Patents case provides support for all three methods, but the results suggest that the first-order autoregressive modeling method is the most robust. Additionally, the autoregressive modeling approach is likely to generate more intuitive results for an analyst. Ground truth analysis confirms nearly all of the outliers that were detected. While the majority of the outliers were due to benign and easily explainable situations and system contexts and the minority were due to malicious activity, the approach does not yield an inordinate amount of search hits to examine and validate. This research thus provides a new computational approach for locating digital forensic evidence.
%G English
%Z TC 11
%Z WG 11.9
%2 https://inria.hal.science/hal-01716401/document
%2 https://inria.hal.science/hal-01716401/file/456364_1_En_9_Chapter.pdf
%L hal-01716401
%U https://inria.hal.science/hal-01716401
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-AICT
%~ IFIP-TC
%~ IFIP-WG
%~ IFIP-TC11
%~ IFIP-DF
%~ IFIP-WG11-9
%~ IFIP-AICT-511