title: Generating a Corpus of Mobile Forensic Images for Masquerading user Experimentation.
abstract: The Periodic Mobile Forensics (PMF) system investigates user behavior on mobile devices. It applies forensic techniques to an enterprise mobile infrastructure, utilizing an on-device agent named TractorBeam. The agent collects changed storage locations for later acquisition, reconstruction, and analysis. TractorBeam provides its data to an enterprise infrastructure that consists of a cloud-based queuing service, relational database, and analytical framework for running forensic processes. During a 3-month experiment with Purdue University, TractorBeam was utilized in a simulated operational setting across 34 users to evaluate techniques to identify masquerading users (i.e., users other than the intended device user). The research team surmises that all masqueraders are undesirable to an enterprise, even when a masquerader lacks malicious intent. The PMF system reconstructed 821 forensic images, extracted one million audit events, and accurately detected masqueraders. Evaluation revealed that developed methods reduced storage requirements 50-fold. This paper describes the PMF architecture, performance of TractorBeam throughout the protocol, and results of the masquerading user analysis.
authors.affiliation: The MITRE Corporation, McLean, VA, 22102.
authors.forename: Mark
authors.initials: M
authors.lastname: Guido
authors.affiliation: The MITRE Corporation, McLean, VA, 22102.
authors.forename: Marc
authors.initials: M
authors.lastname: Brooks
authors.affiliation: The MITRE Corporation, McLean, VA, 22102.
authors.forename: Justin
authors.initials: J
authors.lastname: Grover
authors.affiliation: The MITRE Corporation, McLean, VA, 22102.
authors.forename: Eric
authors.initials: E
authors.lastname: Katz
authors.affiliation: The MITRE Corporation, McLean, VA, 22102.
authors.forename: Jared
authors.initials: J
authors.lastname: Ondricek
authors.affiliation: Purdue University, West Lafayette, IN, 47907.
authors.forename: Marcus
authors.initials: M
authors.lastname: Rogers
authors.affiliation: The MITRE Corporation, McLean, VA, 22102.
authors.forename: Lauren
authors.initials: L
authors.lastname: Sharpe
mesh_terms: D016208:Databases, Factual; D005554:Forensic Medicine; D063731:Mobile Applications; D012984:Software
keywords: corpus; digital and multimedia forensics; forensic images; forensic science; masquerading; mobile