Visual Analysis Transcript

Screen 1
[Narrator]
Your supervisor has called you in to meet with her about the increasing volume of data your office is required to process every day.
[Supervisor]
“Great news! The Chief supports our plans to purchase the visual analysis software you were talking about! I convinced him that it will make us so much more productive. We'll be able to get results to agents in weeks, rather than months.”

Screen 2
[Supervisor]
“The Chief needs your white paper defending the purchase before the end of next week. Be sure to explain the difficulties involved in processing large volumes of data and how new visual analysis techniques and applications can help.”

Screen 3
[Supervisor]
“Make sure you include information on specific techniques, plus information on the different applications. Be thorough—I'll probably use your paper at some point to brief the rest of the team!”

Screen 4
[Supervisor]
“Now, what have I forgotten? [pause] Oh, [pause] right, [pause] you'll also need to include a section on software and platforms on the market today. See if you can spend some time piloting one of the tools in your report. Prepare your implementation recommendations, including a cost-benefit analysis. The selection process will flow more smoothly if we can summarize the science and implementation requirements associated with the different applications.”

Screen 5
[Supervisor]
“Thanks again for going above and beyond the call of duty for us! I look forward to receiving your report.”

Digital forensic investigations often involve large amounts of data. A modern hard drive can store 1 terabyte (TB) or more of data. USB sticks are in the multiple gigabyte (GB) range, and network traffic represents more data than can be captured and stored, much less analyzed. The sheer volume of data can present challenges for the investigator, resulting in incomplete analysis and incorrect conclusions. A greater investment of time is not necessarily the answer. The investigator needs new tools and techniques that can quickly and reliably identify data points and information that require further analysis. Visual analysis meets those needs.

In the scenario, your supervisor agrees with your concerns about your team's ability to analyze large volumes of data. She has obtained funds for visual analytics technology, but she needs a written rationale and recommendations to present to her boss. The right decisions will increase the productivity of every member of your team, so you are anxious to get started!

The goal of this project is to present different types of visual analysis, cases where it is has been used, and options for implementation. The project consists of six steps, culminating in the submission of a white paper advocating for the purchase of visual analysis tools for a department that is overwhelmed with the demands of analyzing large data sets.

Your white paper will consist of the following sections:

1. Description of the problems presented by large volumes of data in forensic investigations
2. Discussion of how visual analytics can help in the analysis of large volumes of data
3. Explanation of the different applications of visual analysis
4. Evaluation of visual analytics software and platforms that summarizes and illustrates key software features
5. Implementation recommendations, including a cost-benefit analysis

Step 1: Explore Processing and Analysis Challenges

You're ready to begin writing your paper. Your supervisor has recommended that you begin by explaining the problems that can arise when analysts are tasked with processing and analyzing a large volume of forensic data. Data can include logs and other sources which have time (temporal) and spatial (geospatial) components. Tasks can include event correlation and pattern analysis. An analysis that misses relevant data points or connections within the data can be a significant problem. Difficulty representing specific data types (e.g., temporal, geospatial) in their native formats is another example of a potential problem. The first section of your paper needs to articulate these challenges in a way that nonexperts will understand.

Develop a 2- to 3-page discussion of processing and analysis challenges using in-class and outside resources. Peer-reviewed research should be cited to support your arguments and APA format should be used. Review your paper carefully for accuracy and completeness. It will serve as the introduction to the white paper to be submitted in Step 6.

Print

Logs

Processes, tasks, or applications running on computing devices may create log files to record actions taken, data received or sent, problems encountered, or even simple status messages. Examples are the Windows Operating System event logs, the Linux/Unix syslog utility, or an individual program log like the smtpd (mail daemon) log.

Log files are not mandatory. Although most programs have the ability to create logs, this ability is usually configurable, which would allow for it to be turned off completely. Log files may be written locally (for example to the hard disk on which the program creating the log is running) or may be sent remotely to another system.

Without intervention, most log files will grow indefinitely, so system administrators typically clean up log files on a regular basis, preserving old logs according to an established policy or setting them up to delete whenever space is needed for new entries.

Without additional protections, most log files may be manipulated by an attacker or malicious user, or may be corrupted by system or component failures.

Log files are often used when troubleshooting problems or investigating cyberattacks, so it is important for analysts to know the reliability of specific logs as well as to corroborate log entries from different sources. Logs provide a rich source of potential information, although different formats between logs and the sheer volume of data available means that typically automated tools are used to analyze logs and provide leads for investigators to follow.

Print

Sources Which Have Time (Temporal) and Spatial (Geospatial) Components

Data sources may also include items that have time and/or location aspects. For example, cell phone records commonly include the parties to a communication as well as the time of the communication and an approximate location of both cell phones involved in the communication. For another example, GPS devices frequently keep timestamped location records, allowing an analyst to know when a particular device was in a specific location. Similarly, modern automobiles keep timestamped location records, usually accessible via the car's infotainment system. On a typical computer system, the file system maintains records of file creation, access, and modification times, and event logs keep records of system and application activity. In addition, on Windows systems, prefetch files can be used to tell when a user accessed a given file, and timestamped registry entries can be used to tell when certain devices were attached or software installed.

Print

Event Correlation

When multiple data sources contain time and/or location data, analysts can "line up" events in time and/or space to draw conclusions. For example, a person's cell phone may be geolocated to a particular place in a city near a crime scene and temporally confirmed to have been in that location around the time of the crime. Equally important, the same information may be used to show that a person was not at a particular location at a particular time. Another example of event correlation is associating Dynamic Host Client Protocol (DHCP) logs with a user's Internet Protocol (IP) address. DHCP dynamically assigns IP addresses to systems and devices, and these addresses change. If you have a timestamped log indicating activity of interest involving a particular IP address, you want to make sure you know what system had that IP address at the time the log event was created. For another example, it is often useful to correlate badge access records with computer activity, helping to show that a person was or was not in a particular building at the time of an event of interest.

Print

Pattern Analysis

When users, programs, or systems behave in a certain way, they create patterns that may be detected in associated data. For example, a malicious insider who is leaking information to a competitor might come to the office after normal closing time in order to collect sensitive information without co-workers around. Such behavior would be detectable as patterns in badge access logs, computer usage, and perhaps USB stick usage. Conversely, deviations from patterns are also of interest to an analyst. For example, a user who never logs in from home via a Virtual Private Network (VPN) but suddenly does so one time in the middle of the night is worthy of investigation. Automated tools can find patterns in large data sets as well as deviations from these patterns.

Step 2: Research Visual Analysis Techniques

In the previous step, you explored problems related to the processing and analysis of large volumes of data. In this step, you research and discuss techniques associated with efficient and effective visual analysis. Examples include filtering, timeline analysis, and link analysis, as well as utilizing various statistical techniques. In a 2- to 3-page paper, describe these analysis techniques and make a general case for how they can help with processing large amounts of data. Again, please explain the techniques and their use so that a nonexpert can understand. Be sure to cite peer-reviewed research studies (in-class readings and others) and use APA format. Review your paper carefully for accuracy and completeness. It will serve as the second section of the white paper to be submitted in Step 6.

You are now ready to move on to the next section of your paper—applications of visual analysis techniques.

Print

Visual Analysis

Visual analysis takes advantage of the uniquely human ability to process images, such as graphics with typically no or minimal numerical or textual data. Visual analysis uses computing power to process raw data into graphics which are meant to reveal patterns or relationships in the data when viewed by a human. By comparison, other techniques like statistical analysis rely primarily on numerical measures derived from the data. Graphics produced for visual analysis may rely on color, shape, size, location, and relationships to represent aspects of the underlying data. Visual analysis for data analytics should not be confused with visual analysis for artwork, which is the study of the formal elements and other aspects of a work of art.

Filtering

Filtering is an approach used in visual and other data analytic techniques whereby subsets of a data set may be included or excluded based on a rule or characteristic that applies to some but not all of the data. As a simple example, when looking at cell phone records, an analyst may filter for a particular area code or calls made within a specific time window. Data may be filtered on derived or combined attributes as well. For example, an analyst could select only phone calls which appear co-located with a vehicle of interest.

Print

Timeline Analysis

Timeline analysis uses temporal (time) data to order events, usually on a fixed scale. In other words, events are put in chronological order and then a fixed time scale is used so that gaps are apparent as well as any order. Such analysis can help confirm or refute assumptions about the sequence and spacing of events, and when combined with geospatial data can confirm or refute hypotheses about where different entities are at given times. For example, a timeline analysis might indicate that a suspect could not have committed two crimes because the necessary travel time from one site to the other is too short.

Print

Link Analysis

Link analysis uses "keys" to associate entities with each other, usually represented as a directed or undirected graph with nodes (entities) and edges (or links–as in the associations between entities). For example, in a data set of cell phone records, entities might be cell phones and links are calls or text messages between phones (lines between the phones involved in a call or message). Similarly, link analysis may be used to analyze financial data, where individuals are nodes and links represent monetary flow between two individuals. Link analysis can reveal underlying organizational structures, such as who is in charge of an organization, or informal communication flows, such as might be revealed by a link analysis of email messages.

Step 3: Describe Applications of Visual Analysis Techniques

Now that you've described the visual analysis techniques themselves, you are ready to explain how they can be applied to the processing and analysis of specific types of digital forensic data such as phone records, financial transactions, and GPS data. Your supervisor in this scenario also wants you to include descriptions of real cases where specific visual analysis techniques have been used to support investigations. You're confident that you'll be able to pull these examples from open-source searches. This is where you can explain how these techniques have been used to support actual investigations.

In a 2- to 3-page paper, explain the application of the techniques, as well as their use in actual cases so that a nonexpert can understand. Proper research (including in-class readings and others) is an important aspect of this assignment, and APA format should be used. Review your paper carefully for accuracy and completeness. It will serve as the third section of the white paper to be submitted in Step 6.

Once you have developed the applications of visual analysis techniques section, you are ready to move on to the fourth section of your paper—evaluating visual analysis tools.

Print

Descriptions of Real Cases

Visual analysis as an investigative and explanatory tool has been around for decades, but recent increases in computing power and the corresponding increase in accessible (digital) data has led to a boom in tools and real applications. A good case example will include visual analysis as a component of the investigation or presentation. You are not likely to find cases which rely solely on visual analysis techniques, and the visual analysis component may be applied at any phase of the process, including initial exploratory work, lead generation, deep data analysis, and presentation of results.

Step 4: Evaluate Visual Analysis Tools

In the prior step, you investigated the application of visual analysis techniques. In this step, you access the virtual lab to pilot a visual analysis tool, Maltego, view an example report that utilizes Maltego, and use open sources to research visual analysis software and hardware. You also examine the tools in use at other organizations. Based on that information, you summarize the available options for your department and describe the pros and cons of each tool. Remember to include characteristics such as cost (consider all costs, such as training), ease of use, effectiveness, maintenance, scalability, as well as other factors that you find relevant. Should training be part of this?

Use APA format to summarize your findings in a 2- to 3-page paper, written so that a nonexpert can understand. Review your paper carefully for accuracy and completeness. It will serve as the fourth section of the white paper to be submitted in the final step.

Once you have developed the tool evaluation section of your paper, you are ready to move on to the next step in the project—implementation recommendations.

Print

Maltego

Maltego is a visual analysis tool developed by Parteva. It enables the analysis and discovery of data from open source locations, local data imports, and direct data entry into the interface. Maltego allows for a variety of data visualization formats including various types of graphs, charts, and bubble diagrams.

Review the videos below to see how visual analysis software such as Maltego can be used in a diverse range of link and visual analysis scenarios.

Print

Effectiveness

The effectiveness of a tool or technique is a measure of how well the tool or technique performs its intended function. In the case of visual analysis tools and techniques, effectiveness means how well the tool or technique reveals useful information about the data, especially information that would not otherwise be apparent.

Print

Maintenance

Software applications and associated hardware require maintenance in order to sustain a given performance level as well as to improve that performance, such as increasing capacity, speed, or accuracy. Additionally, software frequently requires bug fixes, which may be related to security or performance. Hardware occasionally requires fixes or upgrades as well, especially to improve performance or capacity. Tool or system maintenance may be measured as part of the total cost of ownership (TCO), which also includes the purchase, installation, and operation of the tool or system.

Print

Scalability

Tools and techniques typically have limits or thresholds regarding the amount of data they can process before performance degrades. Scalability is a measure of how well the system may be enhanced to address greater data loads. Some algorithms and tools may be scaled almost indefinitely, while others may not be scaled at all. Most tools and techniques fall somewhere in between, where some scalability can be achieved for a modest relative investment.

Step 5: Develop Implementation Recommendations

In the course of your research, you have learned a lot about visual analysis tools, but this scenario asks you to close the deal with your supervisor’s boss. In other words, based on what you know now, which visual analysis tool(s) will best meet the needs of your department? To answer this question you need to do a cost-benefit analysis that compares the costs of purchasing and implementing the tool(s) with benefits for your department and employer. Examples of benefits could include time and money savings, work quality, staff morale, and professional recognition. Base your ballpark projections on the project scenario and related research (in-class readings, outside resources). Conclude this section of your paper with recommendations for the use of visual analysis tools in this scenario.

The presentation of your analysis and recommendations should be two to three pages. Be sure to use APA format and write so that a nonexpert can understand your recommendations. Review your paper carefully for accuracy and completeness. It will serve as the fifth and final section of the white paper to be submitted in the final step.

Print

Cost-Benefit Analysis

A cost-benefit analysis compares the cost of a tool or technique to its expected benefit. Cost must consider the total cost of ownership (TCO), and includes items such as purchase, installation, operation, and maintenance. Benefit should include direct monetary benefit (immediate and expected) as well as intangible benefits such as reputation, goodwill, safety, and work environment. In general terms, benefit will outweigh cost for good investments, although there are subjective and uncertain elements to both sides of the equation that should be recognized.

Step 6: Submit Your Final Paper

You hope that you have made a watertight case for purchasing the visual analysis tools that your department needs. You are anxious to share the results of your research with your supervisor so she can pass it along to her boss.

Combine the results of Steps 1 through 5 into a single 10- to 15-page Word file (page count excludes images and references) that contains the following five sections:

1. Description of the problems presented by large volumes of data in forensic investigations, especially the ways that such volumes may cloud the analysis and interpretation of the data, and how relationships, patterns, and key data points may be missed in such cases.
2. Discussion of how visual analytics can help in the analysis of large volumes of data. Make sure that you include specific techniques in visual analysis such as filtering, timeline analysis, link, and statistical analysis.
3. Explanation of the different applications of visual analysis such as link, temporal, and geospatial, with examples of past cases in which visual analysis played a key role.
4. Evaluating visual analytics software and platforms that summarizes and illustrates (with screen captures) the features you learned to use while piloting Maltego.
5. Implementation recommendations, including a cost-benefit analysis.

Review your paper carefully for accuracy and completeness, and submit to your supervisor (instructor) for evaluation.

HINTS

Section 4 requires that you evaluate software platforms that can be used for visual analysis. I suggest you research two other tools besides Maltego.

Section 5 requires that you provide a cost-benefit analysis that compares the costs of purchasing and implementing the tool(s) with benefits for your department and employer. Examples of benefits could include time and money savings, work quality, staff morale, and professional recognition. You will, therefore, need to provide a cost-benefit analysis for each tool, to compare the tools and make an implementation choice. A cost-benefit analysis for Maltego will have

Maltego:

Costs:

Purchasing cost $15,000

Yearly maintenance $20,000

XXX

XXX

Total Costs ________

Benefits:

Time and money savings $14,000

Work quality $23,000

Total Benefits _________

Net value ______________

You do the above for each tool, and the one with the highest net value is what you may recommend for implementation.