Catching Insider Data Theft With Stochastic Forensics

Explore stochastic forensics techniques for detecting insider data theft in this Black Hat USA 2012 conference talk. Delve into the statistical patterns present on typical filesystems and learn how copying large amounts of data affects these patterns in distinct ways. Discover how to use mathematical techniques to highlight differences and spot otherwise invisible data theft, even months after its occurrence. Gain insights into emergent properties, observations, analysis methods, and the accuracy of this innovative approach. Understand the limitations of traditional forensics in detecting insider threats and how stochastic forensics overcomes these challenges. Learn to apply statistical laws to predict overall behavior in unpredictable systems and leverage this knowledge for enhanced cybersecurity.

Introduction
Emergent Properties
Observations
Analysis
Affirming the consequent
AV scanning
Copying files
Reverse engineering
Copying
Accuracy