Security, and Intelligence

Transcription

1 Machine Learning Forensics for Law Enforcement, Security, and Intelligence Jesus Mena CRC Press Taylor &. Francis Group Boca Raton London NewYork CRC Press is an imprint of the Taylor & Francis Croup, an Informa business AN AUERBACH BOOK

2 Contents Introduction The Author ix xi Chapter 1 What Is Machine Learning Forensics? Definition Digital Maps and Models: Strategies and Technologies Extractive Forensics: Link Analysis and Text Mining Inductive Forensics: Clustering Incidents and Crimes Deductive Forensics: Anticipating Attacks and Precrimc Fraud Detection: On the Web, Wireless, and in Real Time Cybersecurity Investigations: Self-Organizing and Evolving Analyses Corporate Counterintelligence: Litigation and Competitive Investigations A Machine Learning Forensic Worksheet 32 Chapter 2 Digital Investigative Maps and Models: Strategies and Techniques Forensic Strategies Decompose 2.3 Criminal Data Sets, Reports, the Data 41 and Networks Real Estate, Auto, and Credit Data Sets Psychographic and Demographic Data Sets Internet Data Sets Deep Packet Inspection (DPI) 53 V

3 VI CONTENTS 2.8 Designing a Forensic Framework Tracking Mechanisms Assembling Data Streams Forensic Techniques Investigative Maps Investigative Models 72 Chapter 3 Extractive Forensics: Link Analysis and Text Mining Data Extraction Link Analysis Link Analysis Tools Text Mining Text Mining Tools Online Text Mining Analytics Tools Commercial Text Mining Analytics Software From Extraction to Clustering 123 Chapter 4 Inductive Forensics: Clustering Incidents and Crimes Autonomous Forensics Self-Organizing Maps Clustering Software Commercial Clustering Software Free and Open-Source Clustering Software Mapping Incidents Clustering Crimes From Induction to Deduction 154 Chapter 5 Deductive Forensics: Anticipating Attacks and Precrime Artificial Intelligence and Machine Learning Decision Trees Decision Tree Techniques Rule Generators Decision Tree Tools Free and Shareware Decision Tree Tools Rule Generator Tools Free Rule Generator Tools The Streaming Analytical Forensic Processes Forensic Analysis of Streaming Behaviors Forensic Real-Time Modeling Deductive Forensics for Precrime 192 Chapter 6 Fraud Detection: On the Web, Wireless, and in Real Time Definition and Techniques: Where, Who, and How The Interviews: The Owners, Victims, and Suspects 202

4 CONTENTS VII 6.3 Hie S cene of the Crime: Search for Digital Evidence Four Key Steps in Dealing with Digital Evidence 6.4 Searches for Associations: Discovering Links and Text Concepts Rules offraud: Conditions and Clues A Forensic Investigation Methodology Step One: Understand the Investigation Objective Step Two: Understand the Data Step Three: Data Preparation Strategy Step Four: Forensic Modeling Step Five: Investigation Evaluation Step Six: Detection Deployment Forensic Ensemble Techniques Stage One: Random Sampling Stage Two: Balance the Data Stage Three: Split the Data Stage Four: Rotate the Data 213 Models Stage Five: Evaluate Multiple Stage Six: Create an Ensemble Model Stage Seven: Measure False Positives and Negatives Stage Eight: Deploy and Monitor Stage Nine: Anomaly Detection Fraud Detection Forensic Solutions Assembling an Evolving Fraud Detection Framework 227 Chapter 7 Cybersecurity Investigations: Self- Organizing and Evolving Analyses What Is Cybersecurity Forensics? Cybersecurity and Risk Machine Learning Forensics for Cybersecurity Deep Packet Inspection (DPI) Layer 7: Application Layer 6: Presentation Layer 5: Session Layer 4: Transport Layer 3: Network Layer 2: Data Link Layer 1: Physical Software Tools Using DPI Network Security Tools Combating Phishing Hostile Code The Foreign Threat The CNCI Initiative Details 252

5 VI11 CONTENTS 7.9 Forensic Investigator Toolkit Wireless Hacks Incident Response Check-Off Checklists Digital Fingerprinting 267 Chapter 8 Corporate Counterintelligence: Litigation and Competitive Investigations Corporate Counterintelligence Ratio, Trending, and Anomaly Analyses Investigations Legal Risk Assessment Audit Inventory of External Inputs to the Process Identify Assets and Threats List Risk Tolerance for Major Events List and Evaluate Existing Protection Mechanisms List and Assess Underprotected Assets and Unaddressed Threats Competitive Intelligence Investigations Triangulation Investigations 302 Index 307