Introduction |
|
ix | |
The Author |
|
xi | |
|
Chapter 1 What Is Machine Learning Forensics? |
|
|
1 | (36) |
|
|
1 | (1) |
|
1.2 Digital Maps and Models: Strategies and Technologies |
|
|
2 | (1) |
|
1.3 Extractive Forensics: Link Analysis and Text Mining |
|
|
3 | (4) |
|
1.4 Inductive Forensics: Clustering Incidents and Crimes |
|
|
7 | (3) |
|
1.5 Deductive Forensics: Anticipating Attacks and Precrime |
|
|
10 | (11) |
|
1.6 Fraud Detection: On the Web, Wireless, and in Real Time |
|
|
21 | (3) |
|
1.7 Cybersecurity Investigations: Self-Organizing and Evolving Analyses |
|
|
24 | (4) |
|
1.8 Corporate Counterintelligence: Litigation and Competitive Investigations |
|
|
28 | (4) |
|
1.9 A Machine Learning Forensic Worksheet |
|
|
32 | (5) |
|
Chapter 2 Digital Investigative Maps and Models: Strategies and Techniques |
|
|
37 | (40) |
|
|
37 | (4) |
|
|
41 | (1) |
|
2.3 Criminal Data Sets, Reports, and Networks |
|
|
42 | (3) |
|
2.4 Real Estate, Auto, and Credit Data Sets |
|
|
45 | (1) |
|
2.5 Psychographic and Demographic Data Sets |
|
|
46 | (3) |
|
|
49 | (4) |
|
2.7 Deep Packet Inspection (DPI) |
|
|
53 | (3) |
|
2.8 Designing a Forensic Framework |
|
|
56 | (2) |
|
|
58 | (5) |
|
2.10 Assembling Data Streams |
|
|
63 | (2) |
|
|
65 | (4) |
|
|
69 | (3) |
|
2.13 Investigative Models |
|
|
72 | (5) |
|
Chapter 3 Extractive Forensics: Link Analysis and Text Mining |
|
|
77 | (48) |
|
|
77 | (3) |
|
|
80 | (3) |
|
|
83 | (13) |
|
|
96 | (2) |
|
|
98 | (25) |
|
3.5.1 Online Text Mining Analytics Tools |
|
|
99 | (1) |
|
3.5.2 Commercial Text Mining Analytics Software |
|
|
99 | (24) |
|
3.6 From Extraction to Clustering |
|
|
123 | (2) |
|
Chapter 4 Inductive Forensics: Clustering Incidents and Crimes |
|
|
125 | (34) |
|
|
125 | (4) |
|
|
129 | (3) |
|
|
132 | (6) |
|
4.3.1 Commercial Clustering Software |
|
|
132 | (2) |
|
4.3.2 Free and Open-Source Clustering Software |
|
|
134 | (4) |
|
|
138 | (3) |
|
|
141 | (13) |
|
4.6 From Induction to Deduction |
|
|
154 | (5) |
|
Chapter 5 Deductive Forensics: Anticipating Attacks and Precrime |
|
|
159 | (36) |
|
5.1 Artificial Intelligence and Machine Learning |
|
|
159 | (1) |
|
|
160 | (3) |
|
5.3 Decision Tree Techniques |
|
|
163 | (4) |
|
|
167 | (3) |
|
|
170 | (14) |
|
5.5.1 Free and Shareware Decision Tree Tools |
|
|
179 | (1) |
|
5.5.2 Rule Generator Tools |
|
|
179 | (3) |
|
5.5.3 Free Rule Generator Tools |
|
|
182 | (2) |
|
5.6 The Streaming Analytical Forensic Processes |
|
|
184 | (6) |
|
5.7 Forensic Analysis of Streaming Behaviors |
|
|
190 | (1) |
|
5.8 Forensic Real-Time Modeling |
|
|
191 | (1) |
|
5.9 Deductive Forensics for Precrime |
|
|
192 | (3) |
|
Chapter 6 Fraud Detection: On the Web, Wireless, and in Real Time |
|
|
195 | (38) |
|
6.1 Definition and Techniques: Where, Who, and How |
|
|
195 | (7) |
|
6.2 The Interviews: The Owners, Victims, and Suspects |
|
|
202 | (3) |
|
6.3 The Scene of the Crime: Search for Digital Evidence |
|
|
205 | (2) |
|
6.3.1 Four Key Steps in Dealing with Digital Evidence |
|
|
206 | (1) |
|
6.4 Searches for Associations: Discovering Links and Text Concepts |
|
|
207 | (1) |
|
6.5 Rules of Fraud: Conditions and Clues |
|
|
208 | (1) |
|
6.6 A Forensic Investigation Methodology |
|
|
209 | (3) |
|
6.6.1 Step One: Understand the Investigation Objective |
|
|
209 | (1) |
|
6.6.2 Step Two: Understand the Data |
|
|
210 | (1) |
|
6.6.3 Step Three: Data Preparation Strategy |
|
|
210 | (1) |
|
6.6.4 Step Four: Forensic Modeling |
|
|
210 | (1) |
|
6.6.5 Step Five: Investigation Evaluation |
|
|
211 | (1) |
|
6.6.6 Step Six: Detection Deployment |
|
|
211 | (1) |
|
6.7 Forensic Ensemble Techniques |
|
|
212 | (4) |
|
6.7.1 Stage One: Random Sampling |
|
|
212 | (1) |
|
6.7.2 Stage Two: Balance the Data |
|
|
213 | (1) |
|
6.7.3 Stage Three: Split the Data |
|
|
213 | (1) |
|
6.7.4 Stage Four: Rotate the Data |
|
|
213 | (1) |
|
6.7.5 Stage Five: Evaluate Multiple Models |
|
|
213 | (1) |
|
6.7.6 Stage Six: Create an Ensemble Model |
|
|
214 | (1) |
|
6.7.7 Stage Seven: Measure False Positives and Negatives |
|
|
215 | (1) |
|
6.7.8 Stage Eight: Deploy and Monitor |
|
|
215 | (1) |
|
6.7.9 Stage Nine: Anomaly Detection |
|
|
216 | (1) |
|
6.8 Fraud Detection Forensic Solutions |
|
|
216 | (11) |
|
6.9 Assembling an Evolving Fraud Detection Framework |
|
|
227 | (6) |
|
Chapter 7 Cybersecurity Investigations: Self-Organizing and Evolving Analyses |
|
|
233 | (38) |
|
7.1 What Is Cybersecurity Forensics? |
|
|
233 | (1) |
|
7.2 Cybersecurity and Risk |
|
|
234 | (2) |
|
7.3 Machine Learning Forensics for Cybersecurity |
|
|
236 | (3) |
|
7.4 Deep Packet Inspection (DPI) |
|
|
239 | (3) |
|
7.4.1 Layer 7: Application |
|
|
239 | (1) |
|
7.4.2 Layer 6: Presentation |
|
|
240 | (1) |
|
|
240 | (1) |
|
|
240 | (1) |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
241 | (1) |
|
7.4.8 Software Tools Using DPI |
|
|
241 | (1) |
|
7.5 Network Security Tools |
|
|
242 | (3) |
|
|
245 | (2) |
|
|
247 | (3) |
|
|
250 | (6) |
|
7.8.1 The CNCI Initiative Details |
|
|
252 | (4) |
|
7.9 Forensic Investigator Toolkit |
|
|
256 | (3) |
|
|
259 | (4) |
|
7.11 Incident Response Check-Off Checklists |
|
|
263 | (4) |
|
7.12 Digital Fingerprinting |
|
|
267 | (4) |
|
Chapter 8 Corporate Counterintelligence: Litigation and Competitive Investigations |
|
|
271 | (36) |
|
8.1 Corporate Counterintelligence |
|
|
271 | (3) |
|
8.2 Ratio, Trending, and Anomaly Analyses |
|
|
274 | (2) |
|
8.3 E-Mail Investigations |
|
|
276 | (7) |
|
8.4 Legal Risk Assessment Audit |
|
|
283 | (9) |
|
8.4.2 Inventory of External Inputs to the Process |
|
|
285 | (1) |
|
8.4.3 Identify Assets and Threats |
|
|
286 | (1) |
|
8.4.4 List Risk Tolerance for Major Events |
|
|
286 | (1) |
|
8.4.5 List and Evaluate Existing Protection Mechanisms |
|
|
287 | (1) |
|
8.4.6 List and Assess Underprotected Assets and Unaddressed Threats |
|
|
287 | (5) |
|
8.5 Competitive Intelligence Investigations |
|
|
292 | (10) |
|
8.5 Triangulation Investigations |
|
|
302 | (5) |
Index |
|
307 | |