CYBER POINT INTERNATIONAL LLC — Department of Commerce SBIR Phase II: None

Description

CyberPoint International presents the design of a cross platform product for the autonomous execution of live forensic investigations of Personal Computers, Laptops and Servers leveraging the NIST NSRL corpus and a combination of at least 3 forms of machine learning/artificial intelligent algorithms for the processing of preliminary digital evidence titled TheSieve. We build upon work from our phase one research effort to develop the suspicion score for a file based on an ensemble learning approach for features including entropy, location, size and file type. TheSieve will be a multi-tier product for conducting a live investigation requiring zero installation on target systems. TheSieve possesses the ability to automatically execute evidence collection and analysis techniques using a deterministic rule engine which fires during each step of analysis of a single host. Leveraging probability-based decision tree modeling, TheSieve will automatically offer suggestions on a target system under investigation at the end of collection and analysis. At the conclusion of this research effort, TheSieve will be a functional minimally viable product for conducting a live investigation of malicious code events or system misuse for Mac OS X and Linux endpoints and re-train data models based expert user feedback.