Premium
Generating a Corpus of Mobile Forensic Images for Masquerading user Experimentation
Author(s) -
Guido Mark,
Brooks Marc,
Grover Justin,
Katz Eric,
Ondricek Jared,
Rogers Marcus,
Sharpe Lauren
Publication year - 2016
Publication title -
journal of forensic sciences
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.715
H-Index - 96
eISSN - 1556-4029
pISSN - 0022-1198
DOI - 10.1111/1556-4029.13178
Subject(s) - computer science , digital forensics , audit , mobile device , protocol (science) , cloud computing , computer security , architecture , network forensics , world wide web , operating system , medicine , art , alternative medicine , management , pathology , economics , visual arts
The Periodic Mobile Forensics ( PMF ) system investigates user behavior on mobile devices. It applies forensic techniques to an enterprise mobile infrastructure, utilizing an on‐device agent named TractorBeam. The agent collects changed storage locations for later acquisition, reconstruction, and analysis. TractorBeam provides its data to an enterprise infrastructure that consists of a cloud‐based queuing service, relational database, and analytical framework for running forensic processes. During a 3‐month experiment with Purdue University, TractorBeam was utilized in a simulated operational setting across 34 users to evaluate techniques to identify masquerading users (i.e., users other than the intended device user). The research team surmises that all masqueraders are undesirable to an enterprise, even when a masquerader lacks malicious intent. The PMF system reconstructed 821 forensic images, extracted one million audit events, and accurately detected masqueraders. Evaluation revealed that developed methods reduced storage requirements 50‐fold. This paper describes the PMF architecture, performance of TractorBeam throughout the protocol, and results of the masquerading user analysis.