News Release

UTSA College of Business receives $1 million for digital forensics research

Research will help companies better detect insider threats and enhance computer security

Grant and Award Announcement

University of Texas at San Antonio

Is someone from your organization stealing trade secrets and selling them to your competitors? Does your organization struggle with detecting and stopping Internet attacks? Researchers at The University of Texas at San Antonio (UTSA) College of Business have received two grants totaling $1 million to help companies better detect insider threats and enhance computer security.

UTSA researchers were awarded $797,000 in funding from the Naval Postgraduate School, the U.S. Navy's national security research university, as part of a three-year $1.4 million contract with the U.S. Department of Homeland Security Science and Technology Directorate Cyber Security Division.

UTSA researchers will be responsible for developing an algorithm that detects hostile insiders using digital forensics—the science of discovering, recovering and investigating digital information. The algorithm will help companies detect data exfiltration, employee misconduct, and other unauthorized activity that jeopardizes the organization.

"We are pioneering a new approach in insider threat detection using digital forensics and data mining," said Nicole Beebe, assistant professor of digital forensics and principal investigator of the project. "Previous approaches relied primarily on behavioral analysis from past breaches, but this failed to detect new methods for attacks because no two threats were exactly the same."

The end result will be a computer program that will scan an organization's computer systems, analyze the data and present a report on system usage anomalies.

"The benefit of our system is that it is economical to employ and uses only a small amount of memory, processing power and disk space," said Beebe. "We have found that a common denominator in corporate data theft is digital hoarding. Our system detects hostile insiders by comparing their storage profiles with the storage profile of others in their organization and by detecting deviations in an individual's storage pattern over time."

Daijin Ko, professor of statistics in the UTSA College of Business, is a co-researcher in this project.

A second grant of $205,000 from the Naval Postgraduate School awarded earlier this year will help identify the best means to classify file and data types. Beebe and Minghe Sun, professor of management science in the UTSA College of Business, will evaluate three methods of data type classification and determine the most effective, which will ultimately be shared with the public through open source software.

"Our data type classification research will improve computer security while also developing new and enhanced technologies for detecting, preventing and responding to cyber attacks," said Beebe, who previously worked in federal law enforcement as a digital forensics investigator. "By properly identifying unknown data and file types in a computing environment, we can more accurately deploy security solutions."

This work will aid forensic triage – the first steps taken by an investigator to assess the situation and focus the investigation – by helping investigators target or prioritize search, extraction and analysis of file and data types of greatest interest to their case. This improved efficiency will allow companies to save time spent on analyzing data and eliminate irrelevant cases earlier on in the investigation process.

Throughout the one and a half year project, researchers will train the computer program to find certain types of data and separate them into various categories, much like organizing items into different buckets by type. They will then fine-tune the system to achieve the most accurate and efficient results.

###

The UTSA College of Business offers information security degrees at the undergraduate, graduate and doctoral level. With more than 150 students majoring in this field, coursework includes digital forensics, secure network design, intrusion detection and incident response. UTSA is a designated Center of Academic Excellence in Information Assurance Education and a designated Center of Academic Excellence for Information Assurance Research by the National Security Agency and the Department of Homeland Security.

Nationally ranked and recognized, the UTSA College of Business is accredited by AACSB International and enrolls 5,700 students. The college is dedicated to raising its academic profile to become one of the best business schools recognized for developing "Knowledge for a New World." For more information, visit http://business.utsa.edu.

Connect online with UTSA at http://www.utsa.edu, http://www.facebook.com/utsa, http://www.twitter.com/utsa or http://www.youtube.com/utsa.

About UTSA

The University of Texas at San Antonio (UTSA) is an emerging Tier One research institution specializing in health, energy, security, sustainability, and human and social development. With nearly 31,000 students, it is the largest university in the San Antonio metropolitan region. UTSA advances knowledge through research and discovery, teaching and learning, community engagement and public service. The university embraces multicultural traditions and serves as a center for intellectual and creative resources as well as a catalyst for socioeconomic development and the commercialization of intellectual property – for Texas, the nation and the world.


Disclaimer: AAAS and EurekAlert! are not responsible for the accuracy of news releases posted to EurekAlert! by contributing institutions or for the use of any information through the EurekAlert system.