Chiswick Chap, CC BY-SA 3.0 https://creativecommons.org/licenses/by-sa/3.0, via Wikimedia Commons; cropped to fit
Camouflage and Freezing
The Potoo bird has natural camouflage and employs a fascinating defense – when a potential predator is nearby, it remains motionless, a tactic called freezing (even the baby potoo does this). With the camouflage and stillness (often imitating a branch), predators who detect motion can’t see them. Those predators would need another way to find it; they’d need to rely on something they knew wasn’t quite right, to detect some form of out-of-the-usual pattern.
Let’s say this Predator (P) travels that way every day and the potoo bird (B) is in a different spot every time. If P could take a photo of the scene each day, it wouldn’t notice B, but would potentially notice a change in each photo – an extra tree limb, a longer branch, etc. A branch could have grown, B might not be in the photo, a limb could have broken – so no photo is conclusive. But over time when all the photos are put together, P could potentially be able to a) know when B was there and b) know B’s pattern of movement. P could even potentially create a flipbook from all the photos to actually recreate the movement.
Signs of Random
This collation of seemingly random data points to see what information emerges is call “stochastic analysis” or “stochastic process.” and is a long-standing and time-honored mathematical model for making predictions (e.g., financial opportunities, bacterial growth patterns) based on random occurrences.
You may be familiar with the Monte Carlo simulation, which is a form of stochastic analysis. The Monte Carlo simulation is an estimation method where random variables are applied to potential situations to generate potential outcomes, often for long-term forecasting (e.g., finance, quality control) where there would be ample potentials situations and variables to account for over time. These predictions help industries to assess risk and make more accurate long-term forecasts.
In forensic science we have what’s called Locard’s principle. This principle states that a criminal will a) bring something to the crime scene and b) leave with something from it – both of these can be used as forensic evidence. This was created by Dr. Edmond Locard (1877–1966), a pioneer in forensic science who became known as the “Sherlock Holmes” of Lyon, France.
When someone breaks into a house, there are obvious signs – glass on the floor inside the door, locks show tampering or even destruction, drawers are emptied, and furniture is overturned. The criminals were looking for your valuables. There’s plenty of evidence of give and take.
Insider Threat
But what if the culprit is someone who lives there? Because the person lives there and knows where everything is, there’s no need to break in or turn out all the things. This is called Insider Threat, and can be – whether in physical or cyber security – a rather more difficult criminal to catch than external threats.
How in the world does an investigator know how to determine who did it? Enter “Stochastic Forensics.”
In traditional forensics, the forensics process relies on artifacts. The laptop of the missing person, the crushed cell phone on the floor, the emails of the suspect – there are often many clues available. It can be very difficult to retrace the steps and analyze the clues, but the clues are often there and readily available
With insider cybertheft, there are often no obvious clues – the person showed up and departed on time, there are no real clues left in email, no special accounts were created, no low-and-slow attacks from strange IP addresses, all files and folders are in place.
It gets even stranger – you know something was stolen, but you don’t know what. Among all the people still there and the people who have come and gone in the ordinary course of business, whodunnit? And how?
Analyze numerous scenarios and see what patterns emerge, aka Stochastic forensics.
Stochastic Forensics
Stochastic forensics is a method used in digital forensics to detect and investigate insider data theft without relying on digital artifacts. This technique involves analyzing and reconstructing digital activity to uncover unauthorized actions without the need for traditional digital traces that might be left behind by cybercriminals. Stochastic forensics is particularly useful in cases of insider threats where individuals may not leave typical digital footprints. By focusing on emergent patterns in digital behavior rather than specific artifacts, stochastic forensics provides a unique approach to identifying data breaches and unauthorized activities within digital systems.
Here’s an example:
A large-scale copying of files occurs, thereby disturbing the statistical distribution of filesystem metadata. By examining this disruption in the pattern of file access, stochastic forensics can identify and investigate data theft that would otherwise go unnoticed. This method has been successfully used to detect insider data theft where traditional forensic techniques may fail, showcasing its effectiveness in uncovering unauthorized activities within digital systems.
Stochastic Forensics was created in 2010 by Jonathan Grier when confronted by a months-old potentially cold case of insider threat. (You can find more information and a collection of links about Jonathan Grier, Stochastic Forensics, and related publications here: https://en.wikipedia.org/wiki/Stochastic_forensics#cite_note-7)
While stochastic forensics may not provide concrete proof of data theft, it offers evidence and indications that can guide further investigation, or even crack the case. While it has been criticized as being insufficient to provide credible evidence, it has proved its utility.
Detective, not Philosopher
This is where the phrase “think like Sherlock, not Aristotle” comes into play. Aristotle used logic to prove existence; Sherlock used observation to infer a likely cause. Lacking evidence, one must infer (aka, abductive reasoning). In stochastic forensics, think like Sherlock.
Stochastic forensics is only one part of an investigation, not the entirety. And it’s a specialty. But that doesn’t mean it’s to be disregarded. Law enforcement doesn’t seek to make their job harder by focusing initially and solely on niche or specialized knowledge – they begin with the quickest and easiest ways to attain their goal. But if those ways are unfruitful, or made downright impossible due to the lack of artifacts, then stochastic forensics is one of those tools to which they can turn.
Criminals never cease to find ways to commit crimes, and Protectors never cease to find ways to uncover those commissions. Creativity is a renewable resource.
