Abstract: Apparatus, systems and methods are provided that leverage plugin modules supplemented by machine learning to create a robust and adaptable forensic investigation tool that obtains data from one or more data sources, separates the data into smaller units of data (e.g., deconstructs the data into its smallest logical data items/fields) determines common data types within the smaller units, creates “edges” that match data from the one or more data sources with data already in the system, then determines potentially overlapping clusters of information to identify potential connections between investigations and displays the information on a display in link form or grid form.

Abstract: Apparatus, systems and methods are provided that create an improved forensic investigation graph. Nodes of connected data are clustered according to a maximal nearest neighbor algorithm to create maximal nearest neighbor clusters. A first node of data is directly connected to at least a second node of data and indirectly connected to a third node of data through the second node. The nearest neighbor includes only sets of nodes that are directly connected. A cluster of data includes combinations of connected nodes. A cluster of nearest neighbors only includes combinations of nodes that are directly connected to each other. The maximal nearest neighbor clusters are created by determining all clusters or nearest neighbors and removing all nearest neighbor clusters that are subsets of another nearest neighbor cluster. The maximal nearest neighbor clusters re then displayed on a display. The maximal nearest neighbor clusters represent data acquired in the performance of a forensic investigation.

Abstract: Apparatus, systems and methods for agile network isolation through use of packet level non-repudiation (PLNR) are provided. Using a fast cryptography to verify that incoming packets are undeniably being received from the identified source, real-time attack notifications can be independently verified and shared among the network devices to remove compromised nodes from the network. The ability to collaborate among nodes without trust may be achieved via PLNR, to share attack notifications in real-time may be achieved via Telling Attack Layer (TATL), and to establish the identity of an attack in a permanent and binding way may be achieved via DISCOvery (DISCO).

Abstract: Apparatus, systems and methods for agile network isolation through use of packet level non-repudiation (PLNR) are provided. Using a fast cryptography to verify that incoming packets are undeniably being received from the identified source, real-time attack notifications can be independently verified and shared among the network devices to remove compromised nodes from the network. The ability to collaborate among nodes without trust may be achieved via PLNR, to share attack notifications in real-time may be achieved via Telling Attack Layer (TATL), and to establish the identity of an attack in a permanent and binding way may be achieved via DISCOvery (DISCO).

Abstract: Apparatus, systems and methods for agile network isolation through use of packet level non-repudiation (PLNR) are provided. Using a fast cryptography to verify that incoming packets are undeniably being received from the identified source, real-time attack notifications can be independently verified and shared among the network devices to remove compromised nodes from the network. The ability to collaborate among nodes without trust may be achieved via PLNR, to share attack notifications in real-time may be achieved via Telling Attack Layer (TATL), and to establish the identity of an attack in a permanent and binding way may be achieved via DISCOvery (DISCO).

Abstract: Apparatus and methods are provided for performing a digital forensic investigation. Aspects of the apparatus and methods select data on a data source and mark and/or copy this selected data to a storage device in a forensically sound manner. Information related to the location of the selected data may also be stored on the storage device.

Abstract: The present invention is directed to a method for forensic examination of data access of an information system. The invention allows a user to determine the occurrence and nature of data access. In particular, it allows the user to determine if data were copied. The invention does not require modification of the information system or data beforehand, and requires access to no artifact or evidence other than information system itself.

Abstract: Systems and methods for anonymous operation over a non-private network is provided. A mirror of at least a portion of the network is generated and stored on one or more secure machines such that a user is capable of performing one or more standard network operations on the mirror. If real-time network information is desired, the user sends a request to a virtual machine that performs the request as if it originated at the virtual machine then forwards the retrieved information to the user's machine.

Abstract: Apparatus and methods are provided for performing a digital forensic investigation. Aspects of the apparatus and methods determine the location of forensically relevant data on a data source and copy this relevant data to a storage device in a forensically sound manner. Information related to the location of the relevant data may also be stored on the storage device.

Abstract: Apparatus and methods are provided for performing a digital forensic investigation. Aspects of the apparatus and methods determine the location of forensically relevant data on a data source and copy this relevant data to a storage device in a forensically sound manner. Information related to the location of the relevant data may also be stored on the storage device.

Abstract: The following abstract is not intended as a limiting description of the invention. Apparatus and methods are provided for detecting in real-time, data access in an information or file system and generating an alert to indicate a type of access. File activity is monitored on a network device over discrete, uninterrupted time periods. A determination is made whether a minimum number of files within a group of files were accessed during at least one of the time periods. If enough files were accessed during the time period a determination is made whether they were all accessed by a single action. The pattern of the file access is analyzed and compared to known patterns of access and an alert may be generated to indicate the results of the comparison.

Abstract: Computer program products, methods, systems, apparatus, and computing entities are provided for monitoring and reporting user activities. In one embodiment, a monitoring application executing on a monitoring computing entity can record information/data about a user's Internet activities or computing-related activities (e.g., including content accessed by the user). Then, a reporting application can generate reports of the user's Internet activities or computing-related activities (e.g., including content accessed by the user).