Engineering Commons^™

Forensicast: A Non-Intrusive Approach & Tool For Logical Forensic Acquisition & Analysis Of The Google Chromecast Tv, Alex Sitterer, Nicholas Dubois, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The era of traditional cable Television (TV) is swiftly coming to an end. People today subscribe to a multitude of streaming services. Smart TVs have enabled a new generation of entertainment, not only limited to constant on-demand streaming as they now offer other features such as web browsing, communication, gaming etc. These functions have recently been embedded into a small IoT device that can connect to any TV with High Definition Multimedia Interface (HDMI) input known as Google Chromecast TV. Its wide adoption makes it a treasure trove for potential digital evidence. Our work is the primary source on forensically …

Forensic Artifact Finder (Forensicaf): An Approach & Tool For Leveraging Crowd-Sourced Curated Forensic Artifacts, Tyler Balon, Krikor Herlopian, Ibrahim Baggili, Cinthya Grajeda-Mendez

Electrical & Computer Engineering and Computer Science Faculty Publications

Current methods for artifact analysis and understanding depend on investigator expertise. Experienced and technically savvy examiners spend a lot of time reverse engineering applications while attempting to find crumbs they leave behind on systems. This takes away valuable time from the investigative process, and slows down forensic examination. Furthermore, when specific artifact knowledge is gained, it stays within the respective forensic units. To combat these challenges, we present ForensicAF, an approach for leveraging curated, crowd-sourced artifacts from the Artifact Genome Project (AGP). The approach has the overarching goal of uncovering forensically relevant artifacts from storage media. We explain our approach …

Duck Hunt: Memory Forensics Of Usb Attack Platforms, Tyler Thomas, Mathew Piscitelli, Bhavik Ashok Nahar, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

To explore the memory forensic artifacts generated by USB-based attack platforms, we analyzed two of the most popular commercially available devices, Hak5's USB Rubber Ducky and Bash Bunny. We present two open source Volatility plugins, usbhunt and dhcphunt, which extract artifacts generated by these USB attacks from Windows 10 system memory images. Such artifacts include driver-related diagnostic events, unique device identifiers, and DHCP client logs. Our tools are capable of extracting metadata-rich Windows diagnostic events generated by any USB device. The device identifiers presented in this work may also be used to definitively detect device usage. Likewise, the DHCP logs …

Another Brick In The Wall: An Exploratory Analysis Of Digital Forensics Programs In The United States, Syria Mccullough, Stella Abudu, Ebere Onwubuariri, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

We present a comprehensive review of digital forensics programs offered by universities across the United States (U.S.). While numerous studies on digital forensics standards and curriculum exist, few, if any, have examined digital forensics courses offered across the nation. Since digital forensics courses vary from university to university, online course catalogs for academic institutions were evaluated to curate a dataset. Universities were selected based on online searches, similar to those that would be made by prospective students. Ninety-seven (n = 97) degree programs in the U.S. were evaluated. Overall, results showed that advanced technical courses are missing from curricula. We …

Zooming Into The Pandemic! A Forensic Analysis Of The Zoom Application, Andrew Mahr, Meghan Cichon, Sophia Mateo, Cinthya Grajeda, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The global pandemic of COVID-19 has turned the spotlight on video conferencing applications like never before. In this critical time, applications such as Zoom have experienced a surge in its user base jump over the 300 million daily mark (ZoomBlog, 2020). The increase in use has led malicious actors to exploit the application, and in many cases perform Zoom Bombings. Therefore forensically examining Zoom is inevitable. Our work details the primary disk, network, and memory forensic analysis of the Zoom video conferencing application. Results demonstrate it is possible to find users' critical information in plain text and/or encrypted/encoded, such …

Memory Foreshadow: Memory Forensics Of Hardware Cryptocurrency Wallets – A Tool And Visualization Framework, Tyler Thomas, Mathew Piscitelli, Ilya Shavrov, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

We present Memory FORESHADOW: Memory FOREnSics of HArDware cryptOcurrency Wallets. To the best of our knowledge, this is the primary account of cryptocurrency hardware wallet client memory forensics. Our exploratory analysis revealed forensically relevant data in memory including transaction history, extended public keys, passphrases, and unique device identifiers. Data extracted with FORESHADOW can be used to associate a hardware wallet with a computer and allow an observer to deanonymize all past and future transactions due to hierarchical deterministic wallet address derivation. Additionally, our novel visualization framework enabled us to measure both the persistence and integrity of artifacts produced by the …

Exploring The Learning Efficacy Of Digital Forensics Concepts And Bagging & Tagging Of Digital Devices In Immersive Virtual Reality, Courtney Hassenfeldt, Jillian Jacques, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

This work presents the first account of evaluating learning inside a VR experience created to teach Digital Forensics (DF) concepts, and a hands-on laboratory exercise in Bagging & Tagging a crime scene with digital devices. First, we designed and developed an immersive VR experience which included a lecture and a lab. Next, we tested it with (n = 57) participants in a controlled experiment where they were randomly assigned to a VR group or a physical group. Both groups were subjected to the same lecture and lab, but one was in VR and the other was in the real world. …

First Year Students' Experience In A Cyber World Course - An Evaluation, Frank Breitinger, Ryan Tully-Doyle, Kristen Przyborski, Lauren Beck, Ronald S. Harichandran

Electrical & Computer Engineering and Computer Science Faculty Publications

Although cybersecurity is a major present concern, it is not a required subject in University. In response, we developed Cyber World which introduces students to eight highly important cybersecurity topics (primarily taught by none cybersecurity experts). We embedded it into our critical thinking Common Course (core curriculum) which is a team-taught first-year experience required for all students. Cyber World was first taught in Fall 2018 to a cohort of over 150 students from various majors at the University of New Haven. This article presents the evaluation of our Fall taught course. In detail, we compare the performance of Cyber World …

Founding The Domain Of Ai Forensics, Ibrahim Baggili, Vahid Behzadan

Electrical & Computer Engineering and Computer Science Faculty Publications

With the widespread integration of AI in everyday and critical technologies, it seems inevitable to witness increasing instances of failure in AI systems. In such cases, there arises a need for technical investigations that produce legally acceptable and scientifically indisputable findings and conclusions on the causes of such failures. Inspired by the domain of cyber forensics, this paper introduces the need for the establishment of AI Forensics as a new discipline under AI safety. Furthermore, we propose a taxonomy of the subfields under this discipline, and present a discussion on the foundational challenges that lay ahead of this new research …

Map My Murder: A Digital Forensic Study Of Mobile Health And Fitness Applications, Courtney Hassenfeldt, Shabana Baig, Ibrahim Baggili, Xiaolu Zhang

Electrical & Computer Engineering and Computer Science Faculty Publications

The ongoing popularity of health and fitness applications catalyzes

the need for exploring forensic artifacts produced by them. Sensitive

Personal Identifiable Information (PII) is requested by the applications

during account creation. Augmenting that with ongoing

user activities, such as the user’s walking paths, could potentially

create exculpatory or inculpatory digital evidence. We conducted

extensive manual analysis and explored forensic artifacts produced

by (n = 13) popular Android mobile health and fitness applications.

We also developed and implemented a tool that aided in the timely

acquisition and identification of artifacts from the examined applications.

Additionally, our work explored the type of …

Iot Ignorance Is Digital Forensics Research Bliss: A Survey To Understand Iot Forensics Definitions, Challenges And Future Research Directions, Tina Wu, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Interactions with IoT devices generates vast amounts of personal data that can be used as a source of evidence in digital investigations. Currently, there are many challenges in IoT forensics such as the difficulty in acquiring and analysing IoT data/devices and the lack IoT forensic tools. Besides technical challenges, there are many concepts in IoT forensics that have yet to be explored such as definitions, experience and capability in the analysis of IoT data/devices and current/future challenges. A deeper understanding of these various concepts will help progress the field. To achieve this goal, we conducted a survey which received 70 …

”Cyberworld” As A Theme For A University-Wide First-Year Common Course, Kristen Przyborski, Frank Breitinger, Lauren Beck, Ronald S. Harichandran

Engineering and Applied Science Education Faculty Publications

Nowadays we all live in a cyber world and use the internet for emailing, banking, streaming video, shopping, reading news, or other activities. Given all the time people spend online, it is important that all students (regardless of their major) learn some basics about living in a cyber world, e.g., strategies for online safety, impact of artificial intelligence, digital forensics or ancestry.com. To facilitate students from many majors to learn about important issues related to the internet, eight faculty from a variety of disciplines at the University of New Haven integrated the theme of Cyber World into our team-taught, first-year …

On Efficiency Of Artifact Lookup Strategies In Digital Forensics, Lorenz Liebler, Patrick Schmitt, Harald Baier, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

In recent years different strategies have been proposed to handle the problem of ever-growing digital forensic databases. One concept to deal with this data overload is data reduction, which essentially means to separate the wheat from the chaff, e.g., to filter in forensically relevant data. A prominent technique in the context of data reduction are hash-based solutions. Data reduction is achieved because hash values (of possibly large data input) are much smaller than the original input. Today's approaches of storing hash-based data fragments reach from large scale multithreaded databases to simple Bloom filter representations. One main focus was put on …

Tin Assisted Fully Exposed Platinum Clusters Stabilized On Defect-Rich Graphene For Dehydrogenation Reaction, Jiayun Zhang, Yuchen Deng, Xiangbin Cai, Yunlei Chen, Mi Peng, Zhimin Jia, Zheng Jiang, Pengju Ren, Siyu Yao, Jinglin Xie, Dequan Xiao, Xiao-Dong Wen, Ning Wang, Hongyang Liu, Ding Ma

Chemistry and Chemical Engineering Faculty Publications

Tin assisted fully exposed Pt clusters are fabricated on the core-shell nanodiamond@graphene (ND@G) hybrid support (a-PtSn/ND@G). The obtained atomically dispersed Pt clusters, with an average Pt atom number of 3, were anchored over the ND@Gsupport by the assistance of Sn atoms as a partition agent and through the Pt-C bond between Pt clusters and defect-rich graphene nanoshell. The atomically dispersed Pt clusters guaranteed a full metal availability to the reactants, a high thermal stability, and an optimized adsorption/desorption behavior. It inhibits the side reactions and enhances catalytic performance in direct dehydrogenation of n-butane at a low temperature of 450 °C, …

Immersive Virtual Reality Attacks And The Human Joystick, Peter Casey, Ibrahim Baggili, Ananya Yarramreddy

Electrical & Computer Engineering and Computer Science Faculty Publications

This is one of the first accounts for the security analysis of consumer immersive Virtual Reality (VR) systems. This work breaks new ground, coins new terms, and constructs proof of concept implementations of attacks related to immersive VR. Our work used the two most widely adopted immersive VR systems, the HTC Vive, and the Oculus Rift. More specifically, we were able to create attacks that can potentially disorient users, turn their Head Mounted Display (HMD) camera on without their knowledge, overlay images in their field of vision, and modify VR environmental factors that force them into hitting physical objects and …

Frameup: An Incriminatory Attack On Storj: A Peer To Peer Blockchain Enabled Distributed Storage System, Xiaolu Zhang, Justin Grannis, Ibrahim Baggili, Nicole Lang Beebe

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we present a primary account of frameup, an incriminatory attack made possible because of existing implementations in distributed peer to peer storage. The frameup attack shows that an adversary has the ability to store unencrypted data on the hard drives of people renting out their hard drive space. This is important to forensic examiners as it opens the door for possibly framing an innocent victim. Our work employs Storj as an example technology, due to its popularity and market size. Storj is a blockchain enabled system that allows people to rent out their hard drive space …

Timeline2gui: A Log2timeline Csv Parser And Training Scenarios, Mark Debinski, Parvathy Mohan, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

Crimes involving digital evidence are getting more complex due to the increasing storage capacities and utilization of devices. Event reconstruction (i.e., understanding the timeline) is an essential step for investigators to understand a case where a prominent tool is Log2Timeline (a tool that creates super timelines which is a combination of several log files and events throughout a system). While these timelines provide great evidence and help to understand a case, they are complex and require tools as well as training scenarios. In this paper we present Timeline2GUI an easy-to-use python implementation to analyze CSV log files create by Log2Timeline. …

A Practitioner Survey Exploring The Value Of Forensic Tools, Ai, Filtering, & Safer Presentation For Investigating Child Sexual Abuse Material, Laura Sanchez, Cinthya Grajeda, Ibrahim Baggili, Cory Hall

Electrical & Computer Engineering and Computer Science Faculty Publications

For those investigating cases of Child Sexual Abuse Material (CSAM), there is the potential harm of experiencing trauma after illicit content exposure over a period of time. Research has shown that those working on such cases can experience psychological distress. As a result, there has been a greater effort to create and implement technologies that reduce exposure to CSAM. However, not much work has explored gathering insight regarding the functionality, effectiveness, accuracy, and importance of digital forensic tools and data science technologies from practitioners who use them. This study focused specifically on examining the value practitioners give to the tools …

A Versatile Route To Fabricate Single Atom Catalysts With High Chemoselectivity, Xiaohui He, Qian He, Yuchen Deng, Mi Peng, Hongyu Chen, Ying Zhang, Siyu Yao, Mengtao Zhang, Dequan Xiao, Ding Ma, Binghui Ge, Hongbing Ji

Chemistry and Chemical Engineering Faculty Publications

Preparation of single atom catalysts (SACs) is of broad interest to materials scientists and chemists but remains a formidable challenge. Herein, we develop an efficient approach to synthesize SACs via a precursor-dilution strategy, in which metalloporphyrin (MTPP) with target metals are co-polymerized with diluents (tetraphenylporphyrin, TPP), followed by pyrolysis to N-doped porous carbon supported SACs (M₁/N-C). Twenty-four different SACs, including noble metals and non-noble metals, are successfully prepared. In addition, the synthesis of a series of catalysts with different surface atom densities, bi-metallic sites, and metal aggregation states are achieved. This approach shows remarkable adjustability and generality, providing …

Anchoring Cu 1 Species Over Nanodiamond-Graphene For Semi-Hydrogenation Of Acetylene, Fei Huang, Yuchen Deng, Yunlei Chen, Xiangbin Cai, Mi Peng, Zhimin Jia, Jinglin Xie, Dequan Xiao, Xiaodong Wen, Ning Wang, Zheng Jiang, Hongyang Liu, Ding Ma

Chemistry and Chemical Engineering Faculty Publications

The design of cheap, non-toxic, and earth-abundant transition metal catalysts for selective hydrogenation of alkynes remains a challenge in both industry and academia. Here, we report a new atomically dispersed copper (Cu) catalyst supported on a defective nanodiamondgraphene (ND@G), which exhibits excellent catalytic performance for the selective conversion of acetylene to ethylene, i.e., with high conversion (95%), high selectivity (98%), and good stability (for more than 60 h). The unique structural feature of the Cu atoms anchored over graphene through Cu-C bonds ensures the effective activation of acetylene and easy desorption of ethylene, which is the key for the outstanding …

Inception: Virtual Space In Memory Space In Real Space, Peter Casey, Rebecca Lindsay-Decusati, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

Virtual Reality (VR) has become a reality. With the technology's increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional “dead” analysis. Following the trend of antiforensics, evidence of an attack may only be found in memory, along with many other volatile data points. Our work provides the primary account for the memory forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from memory that are relevant to the VE, and is also capable …

Mrsh-Mem: Approximate Matching On Raw Memory Dumps, Lorenz Liebler, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

This paper presents the fusion of two subdomains of digital forensics: (1) raw memory analysis and (2) approximate matching. Specifically, this paper describes a prototype implementation named MRSH-MEM that allows to compare hard drive images as well as memory dumps and therefore can answer the question if a particular program (installed on a hard drive) is currently running / loaded in memory. To answer this question, we only require both dumps or access to a public repository which provides the binaries to be tested. For our prototype, we modified an existing approximate matching algorithm named MRSH-NET and combined it with …

Au@H-Al2o3 Analogic Yolk–Shell Nanocatalyst For Highly Selective Synthesis Of Biomass-Derived D-Xylonic Acid Via Regulation Of Structure Effects, Jiliang Ma, Zewei Liu, Junlong Song, Linxin Zhong, Dequan Xiao, Hongxia Xi, Xuehui Li, Runcang Sun, Xinwen Peng

Chemistry and Chemical Engineering Faculty Publications

Selective oxidation of biomass-based monosaccharides into value-added sugar acids is highly desired, but limited success of producing D-xylonic acid has been achieved. Herein, we report an efficient catalyst system, viz., Au nanoparticles anchored on the inner walls of hollow Al₂O₃ nanospheres (Au@h- Al₂O₃), which could catalyze the selective oxidation of D-xylose into D-xylonic acid under base-free conditions. The mesoporous Al₂O₃ shell as the adsorbent first adsorbed D-xylose. Then, the interface of Au nanoparticles and Al₂O₃ as active sites spontaneously dissociated O₂, and …

Androparse - An Android Feature Extraction Framework & Dataset, Robert Schmicker, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Android malware has become a major challenge. As a consequence, practitioners and researchers spend a significant time analyzing Android applications (APK). A common procedure (especially for data scientists) is to extract features such as permissions, APIs or strings which can then be analyzed. Current state of the art tools have three major issues: (1) a single tool cannot extract all the significant features used by scientists and practitioners (2) Current tools are not designed to be extensible and (3) Existing parsers do not have runtime efficiency. Therefore, this work presents AndroParse which is an open-source Android parser written in Golang …

Atomically Dispersed Pd On Nanodiamond/Graphene Hybrid For Selective Hydrogenation Of Acetylene, Fei Huang, Yuchen Deng, Yunlei Chen, Xiangbin Cai, Mia Peng, Zhimin Jia, Pengju Ren, Dequan Xiao, Xiaodong Wen, Ning Wang, Hongyang Liu, Ding Ma

Chemistry and Chemical Engineering Faculty Publications

An atomically dispersed palladium (Pd) catalyst supported onto a defective nanodiamond-graphene (ND@G) is reported here for selective hydrogenation of acetylene in the presence of abundant ethylene. The catalyst exhibits remarkable performance for the selective conversion of acetylene to ethylene: high conversion (100%), ethylene selectivity (90%), and good stability (i.e., steady for at least 30 hours). The unique struc-ture of the catalyst (i.e., atomically dispersion of Pd atoms on graphene through Pd-C bond anchoring) ensure the facile desorption of ethylene against the over-hydrogenation of ethylene to undesired ethane, which is the key for the outstanding selectivity of the catalyst.

I Know What You Did Last Summer: Your Smart Home Internet Of Things And Your Iphone Forensically Ratting You Out, Gokila Dorai, Shiva Houshmand, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The adoption of smart home Internet of Things (IoT) devices continues to grow. What if your devices can snitch on you and let us know where you are at any given point in time? In this work we examined the forensic artifacts produced by Nest devices, and in specific, we examined the logical backup structure of an iPhone used to control a Nest thermostat, Nest Indoor Camera and a Nest Outdoor Camera. We also integrated the Google Home Mini as another method of controlling the studied Smart Home devices. Our work is the primary account for the examination of Nest …

Digital Forensics In The Next Five Years, Laoise Luciano, Ibrahim Baggili, Mateusz Topor, Peter Casey, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

Cyber forensics has encountered major obstacles over the last decade and is at a crossroads. This paper presents data that was obtained during the National Workshop on Redefining Cyber Forensics (NWRCF) on May 23-24, 2017 supported by the National Science Foundation and organized by the University of New Haven. Qualitative and quantitative data were analyzed from twenty-four cyber forensics expert panel members. This work identified important themes that need to be addressed by the community, focusing on (1) where the domain currently is; (2) where it needs to go and; (3) steps needed to improve it. Furthermore, based on the …

Chaos Firefly Algorithm With Self-Adaptation Mutation Mechanism For Solving Large-Scale Economic Dispatch With Valve-Point Effects And Multiple Fuel Options, Yude Yang, Bori Wei, Hui Liu, Yiyi Zhang, Junhui Zhao, Emad Manla

Electrical & Computer Engineering and Computer Science Faculty Publications

This paper presents a new metaheuristic optimization algorithm, the firefly algorithm (FA), and an enhanced version of it, called chaos mutation FA (CMFA), for solving power economic dispatch problems while considering various power constraints, such as valve-point effects, ramp rate limits, prohibited operating zones, and multiple generator fuel options. The algorithm is enhanced by adding a new mutation strategy using self-adaptation parameter selection while replacing the parameters with fixed values. The proposed algorithm is also enhanced by a self-adaptation mechanism that avoids challenges associated with tuning the algorithm parameters directed against characteristics of the optimization problem to be solved. The …

Forensic Analysis Of Immersive Virtual Reality Social Applications: A Primary Account, Ananya Yarramreddy, Peter Gromkowski, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Our work presents the primary account for exploring the forensics of immersive Virtual Reality (VR) systems and their social applications. The Social VR applications studied in this work include Bigscreen, Altspace VR, Rec Room and Facebook Spaces. We explored the two most widely adopted consumer VR systems: the HTC Vive and the Oculus Rift. Our tests examined the efficacy of reconstructing evidence from network traffic as well as the systems themselves. The results showed that a significant amount of forensically relevant data such as user names, user profile pictures, events, and system details may be recovered. We anticipate that this …

Survey Results On Adults And Cybersecurity Education, Frank Breitinger, Joseph Ricci, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Cyberattacks and identity theft are common problems nowadays where researchers often say that humans are the weakest link in the security chain. Therefore, this survey focused on analyzing the interest for adults for ‘cyber threat education seminars’, e.g., how to project themselves and their loved ones. Specifically, we asked questions to understand a possible audience, willingness for paying / time commitment, or fields of interest as well as background and previous training experience. The survey was conducted in late 2016 and taken by 233 participants. The results show that many are worried about cyber threats and about their children exploring …