Zeba Tusnia Towshi

Ph.D. Student, Computer Science (Cybersecurity)
Advised by Dr. Erika Leal · Baylor University
 

Who I Am

I'm a Ph.D. student in Computer Science at Baylor, working under Dr. Erika Leal on digital forensics and cybersecurity. My path here began with a love of math and physics in high school, which grew into a fascination with digital crime investigation and, during my undergraduate years in Bangladesh, into research on intrusion detection. That early spark still drives my work today: using data and AI to recover the evidence attacks leave behind.
 

What I'm Working On

Volatile memory forensics. My current research asks a practical question: when a system is compromised, what evidence survives in RAM, and can we reliably recover it? A computer's memory can hold processes, network connections, credentials, and malware traces that vanish the moment the machine shuts down. Despite how valuable that evidence is, public, reproducible datasets for Linux memory forensics are still scarce, which makes it hard to test and compare forensic tools on common ground.

To close that gap, I'm building a Linux-focused memory forensics dataset organized around specific MITRE ATT&CK behaviors. For each behavior, I run a consistent pipeline: execute the attack behavior, acquire memory with LiME, generate a SHA-256 hash for integrity, analyze the capture with

 Volatility, then compress, verify, and archive the results. Every experiment is documented so the memory evidence can be reproduced and compared, giving researchers clear ground truth that connects a specific executed behavior to the exact artifacts it leaves in memory.

Through this process, I'm identifying which memory artifacts each attack behavior reliably produces, and which Volatility plugins consistently expose them, providing practical answers that matter for anyone doing this kind of investigation.

Looking ahead, I want to address a real pain point I've observed in the field: practitioners currently run multiple separate forensic tools and merge the results by hand, which is slow and error-prone. Later in my Ph.D., I plan to build a single integrated tool that combines the operations of these existing tools into one streamlined workflow.

Why This Matters

Digital evidence in memory is fragile; it's often the only trace of an attack, and it disappears the moment a system is powered down. My research builds the reproducible datasets and ground-truth mappings the forensics community needs to know which tools actually work, and to train the next generation of investigators on evidence that reflects real attacker behavior rather than synthetic examples.

Background

• B.Sc. in Computer Science-  Independent University, Bangladesh
• Undergraduate research on intrusion detection under Dr. Tarem Ahmed (3rd–4th year)
• Publications including work presented at IEEE Access and VTC