Ph.D. Dissertation Defense
Computer Science and Electrical Engineering
University of Maryland, Baltimore County

Applying Data Visualization Techniques to Support the
Analysis of Digital Forensic Data

Timothy Leschke

10:00am-Noon Friday 22 November 2013, ITE 456

The Modern Age of digital forensics is characterized by a proliferation of artifacts, increased data complexity, larger and cheaper data storage, and the emergence of the need for tools that support timeline analysis, anomaly detection, and triage. Traditional text-based digital forensic tools can no longer keep pace with the demands of the modern digital forensic examiner. A new approach for developing digital forensic tools is required if digital forensics is going to avoid becoming stagnant.

We apply the power of data visualization to support the needs of the modern digital forensic examiner. We design and develop a tool called Change-Link; a coordinated and multiple view tool which uses semantic zooming in the form of an overview, treeview, directory content view, and a metadata view to provide an understanding of digital forensic data that changes over time. By using this tool to examine a mock evidence hard drive containing shadow volume data provided by the Microsoft Volume Shadow Copy Service, we demonstrate a way to reduce data complexity and provide better forensic data analysis while supporting timeline analysis, anomaly detection, and a triage of the dataset.

We demonstrate a proof for our broader hypothesis which is data visualization techniques can be developed to support better analysis of digital forensic data.

Committee: Drs. Charles Nicholas (chair), Konstantinos Kalpakis, Dhananjay Phatak, Jian Chen, Clay Shields (Georgetown Univ.), Daniel Quist

The MURF program aims to increase the participation of underrepresented students (such as African American, Hispanic, and Native American; females who are underrepresented in their discipline; or first-generation college students) in science and engineering Ph.D. or M.D./Ph.D. programs and to make Caltech's programs more visible to students not traditionally exposed to Caltech.

Eligibility: Students must be current sophomores through non-graduating seniors and must be U.S. citizens or U.S. permanent residents. A minimum GPA of 3.2 is required.

Competitive applicants will have completed sophomore-level courses in desired research field, have demonstrated through academic and/or co-curricular activities a passion for research, and can articulate how their research interests align with Caltech's research areas. The most competitive applicants will have prior research experience.

Support: MURF students will receive a $6000 award for the ten-week program. An additional $500 housing and travel supplement will be provided.

Application: Online applications are due January 8, 2014.

Ph.D. Dissertation Defense
Computer Science and Electrical Engineering
University of Maryland, Baltimore County

Finding Story Chains and Creating Story Maps in Newswire Articles

Xianshu Zhu

10:00-12:00pm Monday 25 November 2013, ITE 325B

There are huge amounts of news articles about events published on the Internet everyday. The flood of information on the Internet can easily swamp people, which seems to produce more pain than gain. While there are some excellent search engines, such as Google, Yahoo and Bing, to help us retrieve information by simply providing keywords, the problem of information overload makes it hard to understand the evolution of a news story. Conventional search engines display unstructured search results, which are ranked by relevance using keyword-based ranking methods and other more complicated ranking algorithms. However, when it comes to searching for a story (a sequence of events), none of the ranking algorithms above can organize the search results by evolution of the story. Limitations of unstructured search results include: (1) Lack of the big picture on complex stories. In general, news articles tend to describe the news story from different perspectives. For complex news stories, users can spend significant time looking through unstructured search results without being able to see the big picture of the story. For instance, Hurricane Katrina struck New Orleans on August 23, 2005. By typing “Hurricane Katrina” in Google, people can get much information about the event and its impact on the economy, health, and government policies, etc. However, people may feel desperate to sort the information to form a story chain that tells how, for example, Hurricane Katrina has impacted government policies. (2) Hard to find hidden relationships between two events: The connections between news events are sometimes extremely complicated and implicit. It is hard for users to discover the connections without thorough investigation of the search results.

In this dissertation, we seek to extend the capability of existing search engines to output coherent story chains and story maps (a map that demonstrates various perspectives on news events), rather than loosely connected pieces of information. By this means, people can obtain a better understanding of the news story, capture the big picture of the news story quickly, and discover hidden relationships between news events. First of all, algorithms for finding story chains have the following two advantages: (1) they can find out how two events are correlated by finding a chain of events that coherently connect them together. Such story chains will help people discover hidden relationship between two events. (2) they allow users to search by complex queries such as “how is event A related to event B”, which does not work well on conventional keyword-based search engines. Secondly, creating story maps by finding different perspectives on a news story and grouping news articles by the perspectives can help users better capture the big picture of the story and give them suggestions on what directions they can further pursue. From a functionality point of view, the story map is similar to the table of content of a book which gives users a high-level overview of the story and guides them during news reading process.

The specific contributions of this dissertation are: (1) Develop various algorithms to find story chains, including: (a) random walk based story chain algorithm; (b) co-clustering based story chain algorithm which further improves the story chains by grouping semantically close words together and propagating the relevance of word nodes to document nodes; (c) finding story chains by extracting multi-dimensional event profiles from unstructured news articles, which aims to better capture relationships among news events. This algorithm significantly improves the quality of the story chains. (2) Develop an algorithm to create story maps which uses Wikipedia as the knowledge base. News articles are represented in the form of bag-of-aspects instead of bag-of-words. Bag-of-aspects representation allows users to search news articles through different aspects of a news event but not through simple keywords matching.

Committee: Drs. Tim Oates (chair), Tim Finin, Charles Nicholas, Sergei Nirenburg and Doug Oard

The following full-time positions have been posted within the past week to UMBCworks. Login to your account (via the link in the Jobs & Internships topic in myUMBC) and find details and application instructions as well as hundreds of other job postings! 

9262092 - Administrative Assistant - Freestone Environmental
9258745 - Client Services Representative - RainKing Solutions
9262082 - Cyber Analyst Specialist - NJVC, LLC
9262134 - Developer and Technical Positions - CGI Federal
9262128 - Jr. Helpdesk Specialist - Chesapeake Human Resources Services, LLC
9262108 - Hardware Engineer I - SOTECH

The following part-time positions have been posted within the past week to UMBCworks. Login to your account (via the link in the Jobs & Internships topic in myUMBC) and find details and application instructions as well as hundreds of other job postings!

9262132 - PaRaBal, a mobile software analysis and designer is seeking Technical and Liberal Arts majors for this part-time position
MUST be a UMBC Residential Student
International and U.S. Citizens are welcome to apply!!

9262102 - Catering Director - Chick-Fil-A (Landsdowne/Halethorpe)
9262107 - Facilitator - Weekend Residential Rehabilitation - Way Station
9262064 - Receptionist - Bill's Music House (Catonsville)
9262052 - Concierge - Water's Edge Events Center