Related Experiment Video
Updated: Mar 16, 2026
09:49
Holistic Facial Composite Creation and Subsequent Video Line-up Eyewitness Identification Paradigm
Published on: December 24, 2015
14.7K
Generating a Corpus of Mobile Forensic Images for Masquerading user Experimentation
Mark Guido1, Marc Brooks1, Justin Grover1
1The MITRE Corporation, McLean, VA, 22102.
Journal of Forensic Sciences
|August 23, 2016
Summary
The Periodic Mobile Forensics (PMF) system uses the TractorBeam agent to detect unauthorized users on mobile devices. This research significantly reduced storage needs while accurately identifying masqueraders in a 3-month study.
Area of Science:
- Digital Forensics
- Cybersecurity
- Mobile Device Security
Background:
- Mobile devices are integral to enterprise operations.
- Identifying unauthorized users (masqueraders) is crucial for security.
- Existing forensic methods can be resource-intensive.
Purpose of the Study:
- To introduce and evaluate the Periodic Mobile Forensics (PMF) system.
- To assess the effectiveness of the TractorBeam agent in identifying masqueraders.
- To analyze the performance and storage efficiency of the PMF system.
Main Methods:
- Developed and deployed the TractorBeam on-device agent for data collection.
- Utilized a cloud-based infrastructure for data processing and analysis.
- Conducted a 3-month experiment with 34 users in a simulated enterprise environment.
Main Results:
- Successfully reconstructed 821 forensic images and extracted one million audit events.
- Accurately detected masquerading users, regardless of malicious intent.
- Achieved a 50-fold reduction in storage requirements through developed methods.
Conclusions:
- The PMF system, with its TractorBeam agent, is effective in identifying masqueraders.
- The system offers significant improvements in storage efficiency for mobile forensics.
- Continuous monitoring and analysis of mobile device usage are vital for enterprise security.
