Engineering Commons^™

Finding Evidence Of Wordlists Being Deployed Against Ssh Honeypots – Implications And Impacts, Priya Rabadia, Craig Valli

Australian Digital Forensics Conference

This paper is an investigation focusing on activities detected by three SSH honeypots that utilise Kippo honeypot software. The honeypots were located on the same /24 IPv4 network and configured as identically as possible. The honeypots used the same base software and hardware configurations. The data from the honeypots were collected during the period 17th July 2012 and 26th November 2013, a total of 497 active day periods. The analysis in this paper focuses on the techniques used to attempt to gain access to these systems by attacking entities. Although all three honeypots are have the same configuration settings and …

Using Internet Artifacts To Profile A Child Pornography Suspect, Marcus K. Rogers, Kathryn C. Seigfried-Spellar

Journal of Digital Forensics, Security and Law

Digital evidence plays a crucial role in child pornography investigations. However, in the following case study, the authors argue that the behavioral analysis or “profiling” of digital evidence can also play a vital role in child pornography investigations. The following case study assessed the Internet Browsing History (Internet Explorer Bookmarks, Mozilla Bookmarks, and Mozilla History) from a suspected child pornography user’s computer. The suspect in this case claimed to be conducting an ad hoc law enforcement investigation. After the URLs were classified (Neutral; Adult Porn; Child Porn; Adult Dating sites; Pictures from Social Networking Profiles; Chat Sessions; Bestiality; Data Cleaning; …

On Cyber Attacks And Signature Based Intrusion Detection For Modbus Based Industrial Control Systems, Wei Gao, Thomas H. Morris

Journal of Digital Forensics, Security and Law

Industrial control system communication networks are vulnerable to reconnaissance, response injection, command injection, and denial of service attacks. Such attacks can lead to an inability to monitor and control industrial control systems and can ultimately lead to system failure. This can result in financial loss for control system operators and economic and safety issues for the citizens who use these services. This paper describes a set of 28 cyber attacks against industrial control systems which use the MODBUS application layer network protocol. The paper also describes a set of standalone and state based intrusion detection system rules which can be …

Idiographic Digital Profiling: Behavioral Analysis Based On Digital Forensics, Chad M. Steel

Journal of Digital Forensics, Security and Law

Idiographic digital profiling (IDP) is the application of behavioral analysis to the field of digital forensics. Previous work in this field takes a nomothetic approach to behavioral analysis by attempting to understand the aggregate behaviors of cybercriminals. This work is the first to take an idiographic approach by examining a particular subject's digital footprints for immediate use in an ongoing investigation. IDP provides a framework for investigators to analyze digital behavioral evidence for the purposes of case planning, subject identification, lead generation, obtaining and executing warrants, and prosecuting offenders.

On Identities In Modern Networks, Libor Polcak, Radek Hranick, Tomas Martınek

Journal of Digital Forensics, Security and Law

Communicating parties inside computer networks use different kind of identifiers. Some of these identifiers are stable, e.g., logins used to access a specific service, some are only temporary, e.g., dynamically assigned IP addresses. This paper tackles several challenges of lawful interception that emerged in modern networks. The main contribution is the graph model that links identities learnt from various sources distributed in a network. The inferred identities result into an interception of more detailed data in conformance with the issued court order. The approach deals with network address translation, short-lived identifiers and simultaneous usage of different identities. The approach was …

Exploring Forensic Implications Of The Fusion Drive, Shruti Gupta, Marcus Rogers

Journal of Digital Forensics, Security and Law

This paper explores the forensic implications of Apple’s Fusion Drive. The Fusion Drive is an example of auto-tiered storage. It uses a combination of a flash drive and a magnetic drive. Data is moved between the drives automatically to maximize system performance. This is different from traditional caches because data is moved and not simply copied. The research included understanding the drive structure, populating the drive, and then accessing data in a controlled setting to observe data migration strategies. It was observed that all the data is first written to the flash drive with 4 GB of free space always …

Multi-Stakeholder Case Prioritization In Digital Investigations, Joshua I. James

Journal of Digital Forensics, Security and Law

This work examines the problem of case prioritization in digital investigations for better utilization of limited criminal investigation resources. Current methods of case prioritization, as well as observed prioritization methods used in digital forensic investigation laboratories are examined. After, a multi-stakeholder approach to case prioritization is given that may help reduce reputational risk to digital forensic laboratories while improving resource allocation. A survey is given that shows differing opinions of investigation priority between Law Enforcement and the public that is used in the development of a prioritization model. Finally, an example case is given to demonstrate the practicality of the …

An Efficient Similarity Digests Database Lookup – A Logarithmic Divide & Conquer Approach, Frank Breitinger, Christian Rathgeb, Harald Baier

Journal of Digital Forensics, Security and Law

Investigating seized devices within digital forensics represents a challenging task due to the increasing amount of data. Common procedures utilize automated file identification, which reduces the amount of data an investigator has to examine manually. In the past years the research field of approximate matching arises to detect similar data. However, if n denotes the number of similarity digests in a database, then the lookup for a single similarity digest is of complexity of O(n). This paper presents a concept to extend existing approximate matching algorithms, which reduces the lookup complexity from O(n) to O(log(n)). Our proposed approach is based …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

From The Editor, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

In this issue we have three papers that have made the cut. The first paper titled “The Cost of Privacy: Riley v. California’s Impact on Cell Phone Searches” is timely. In 2014 there was a unanimous decision that requires a warrant for all cell phone searches. This has some strong implications on the forensic analysis of mobile phones, and to that end, this article discusses and summarizes this legal precedent with its practical implications.

Leveraging Decentralization To Extend The Digital Evidence Acquisition Window: Case Study On Bittorrent Sync, Mark Scanlon, Jason Farina, Nhien A. Khac, Tahar Kechadi

Journal of Digital Forensics, Security and Law

File synchronization services such as Dropbox, Google Drive, Microsoft OneDrive, Apple iCloud, etc., are becoming increasingly popular in today’s always-connected world. A popular alternative to the aforementioned services is BitTorrent Sync. This is a decentralized/cloudless file synchronization service and is gaining significant popularity among Internet users with privacy concerns over where their data is stored and who has the ability to access it. The focus of this paper is the remote recovery of digital evidence pertaining to files identified as being accessed or stored on a suspect’s computer or mobile device. A methodology for the identification, investigation, recovery and verification …

Book Review: The X-Ways Forensics Practitioner's Guide, Linda Lau

Journal of Digital Forensics, Security and Law

Brett Shavers is a former law enforcement officer, a digital forensics examiner, an adjunct instructor, and a frequent speaker at many conferences. After writing his first book, titled Placing the Suspect Behind the Keyboard: Using Digital Forensics and Investigative Techniques to Identify Cybercrime Suspects, he co-wrote his 2nd book with Eric Zimmerman and Jimmy Weg, who is a knowledgeable technical editor. Both Brett and Eric are experts in cyber forensics, with many years of law enforcement experience at both the state and federal levels.

The Cost Of Privacy: Riley V. California’S Impact On Cell Phone Searches, Jennifer L. Moore, Jonathan Langton, Joseph Pochron

Journal of Digital Forensics, Security and Law

Riley v. California is the United States Supreme Court’s first attempt to regulate the searches of cell phones by law enforcement. The 2014 unanimous decision requires a warrant for all cell phone searches incident to arrest absent an emergency. This work summarizes the legal precedent and analyzes the limitations and practical implications of the ruling. General guidelines for members of the criminal justice system at all levels consistent with the Supreme Court’s decision are provided.

Quantifying Relevance Of Mobile Digital Evidence As They Relate To Case Types: A Survey And A Guide For Best Practice, Shahzad Saleem, Ibrahim Baggili, Oliver Popov

Journal of Digital Forensics, Security and Law

In this work, a survey was conducted to help quantify the relevance of nineteen types of evidence (such as SMS) to seven types of digital investigations associated with mobile devices (MD) (such as child pornography). 97 % of the respondents agreed that every type of digital evidence has a different level of relevance to further or solve a particular investigation. From 55 serious participants, a dataset of 5,772 responses regarding the relevance of nineteen types of digital evidence for all the seven types of digital investigations was obtained. The results showed that (i) SMS belongs to the most relevant type …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Wind Energy In Ireland - An Analysis Of Percentage Error In Forecasting, Michael Mcdonald

Dissertations

This research aimed to examine the percentage error in forecasting of wind energy using datasets from a small wind farm in Ireland. Furthermore, the study aimed to compare this calculated data to the national forecasting percentage errors. Internationally, the electrical sector and society are undergoing a revolution in terms of 'green economy'. This paradigm shift towards renewable energy technologies is recognised as a priority, with diminution of finite fossil fuels at its core. Renewable energy as a sector has provided significant financial stimulation to global economies in recent years. Moreover, wind energy has provided significant amounts of clean electricity throughout …

Toward A Framework For Levels Of Robot Autonomy In Human-Robot Interaction, Jenay Beer, A. D. Fisk, W. A. Rogers

Faculty Publications

Autonomy is a critical construct related to human-robot interaction (HRI) and varies widely across robot platforms. Levels of robot autonomy (LORA), ranging from teleoperation to fully autonomous systems, influence the way in which humans and robots interact with one another. Thus, there is a need to understand HRI by identifying variables that influence—and are influenced by—robot autonomy. Our overarching goal is to develop a framework for LORA in HRI. To reach this goal, our framework draws links between HRI and human-automation interaction, a field with a long history of studying and understanding human-related variables. The construct of autonomy is reviewed …

The Influence Of National Culture On Effectiveness Of Safety Trainings During Postdisaster Reconstruction, Behzad Esmaeili, Kevin Grosskopf, Amy Javernick-Will

Durham School of Architectural Engineering and Construction: Faculty Publications

Non-English speaking workers constitute a disproportionately high number of workers involved in postdisaster reconstruction. Additionally, the rate of fatality among these workers is higher than the industry average. Research shows this population is more prone to unsafe behaviors in the working environment, conceivably because many of these workers are sent into the field prior to any formalized training. Recent studies show that the native culture of construction workers can impact risk-taking behavior. While numerous researchers have attempted to develop training materials for Hispanic workers, the number of studies that consider the impact of native culture on safety behavior is minimal. …

Developing A Conceptual Framework For Modeling Deviant Cyber Flash Mob: A Socio-Computational Approach Leveraging Hypergraph Constructs, Samer Al-Khateeb, Nitin Agarwal

Journal of Digital Forensics, Security and Law

In a Flash Mob (FM) a group of people get together in the physical world perform an unpredicted act and disperse quickly. Cyber Flash Mob (CFM) is the cyber manifestation of flash mob coordinated primarily using social media. Deviant Cyber Flash Mob (or, DCFM) is a special case of CFM, which is categorized as the new face of transnational crime organizations (TCOs). The DCFM phenomenon can be considered as a form of a cyber-collective action that is defined as an action aiming to improve group’s conditions (such as, status or power). In this paper, we conduct a conceptual analysis of …

Synchronization Limits Of Chaotic Circuits, C. M. Church, Stephen R. Addison

Journal of the Arkansas Academy of Science

Through system modeling with electronic circuits, two circuits were constructed that exhibit chaos over a wide ranges of initial conditions. The two circuits were one that modeled an algebraically simple “jerk” function and a resistor-inductor-diode (RLD) circuit where the diode was reverse-biased on the positive voltage cycle of the alternating current source. Using simulation data from other experiments, the waveforms, bifurcation plots, and phase space plots of the concrete circuit were verified. Identical circuits were then built containing variable components and coupled to their original, matching circuits. The variable components were used to observe a wide range of conditions to …

Use Of In-Situ Tests To Identify Soil Behavior Type And Liquefaction Susceptibility Of Sccp Soils, Rajshekhar Sarkar

Theses and Dissertations

For many years, the Cone Penetrometer Test (CPT), Flat Plate Dilatometer Test (DMT) and Standard Penetration Test (SPT) have been used as in-situ tools to assess the liquefaction potential of soils. Given the importance of evaluating liquefaction potential in the South Carolina Coastal Plain (SCCP), research was conducted to study the soil behavior of soils prone to liquefaction, develop site specific correlations between SPT, DMT and CPT testing parameters and evaluate the liquefaction susceptibility of the soils in the SCCP. The SCCP sites studied in this thesis are Sampit (SAM), Gapway (GAP), Hollywood (HWD), Four Hole Swamp (FHS) and Fort …

Secure And Reliable Wireless Communication Through End-To-End-Based Solution, Hossen Asiful Mustafa

Theses and Dissertations

In the past few decades, network architectures and protocols are often designed to achieve a high throughput and a low latency. Security was rarely considered during the initial design phases. As a result, many network systems are insecure by design. Once they are widely deployed, the inherent vulnerabilities may be difficult to eliminate due to the prohibitive update cost. In this dissertation, we examine such types of vulnerabilities in various networks and design end-to-end-based solutions that allow end systems to address such loopholes.

The end-to-end argument was originally proposed to let end hosts implement application-specific functions rather than letting intermediate …

Classification Of Low Velocity Impactors Using Spiral Sensing Of Acousto-Ultrasonic Waves, Chijioke Agbasi

Theses and Dissertations

The non-linear elastodynamics of a flat plate subjected to low velocity foreign body impacts is studied, resembling the space debris impacts on the space structure. The work is based on a central hypothesis that in addition to identifying the impact locations, the material properties of the foreign objects can also be classified using acousto-ultrasonic signals (AUS). Simultaneous localization of impact point and classification of impact object is quite challenging using existing state-of-the-art structural health monitoring (SHM) approaches. Available techniques seek to report the exact location of impact on the structure, however, the reported information is likely to have errors from …

Bio-Inspired And Low-Content Polymer Cement Mortar For Structural Rehabilitation, Nima Zohhadi

Theses and Dissertations

Use of polymers as partial replacement for Portland cement in cement mortar and concrete can diminish several drawbacks of these composites such as low tensile strength and strain capacity, high permeability and low adhesion. Main reasons for the use of polymers are to improve damage tolerance, adhesion, and resistance to water permeation. Various polymers with a wide range of physical and mechanical properties have been used in fabrication of cementitious composites. Typical polymer content for such composites is 5% to 20% (by the weight of cement) for both mortar and concrete. There are also drawbacks associated with the use of …

Development Of High Fidelity Soot Aerosol Dynamics Models Using Method Of Moments With Interpolative Closure, Somesh Roy, P. G. Arias, Vivien R. Lecoustre, Daniel C. Haworth, H. G. Im, Arnaud Trouvé

Mechanical Engineering Faculty Research and Publications

The method of moments with interpolative closure (MOMIC) for soot formation and growth provides a detailed modeling framework maintaining a good balance in generality, accuracy, robustness, and computational efficiency. This study presents several computational issues in the development and implementation of the MOMIC-based soot modeling for direct numerical simulations (DNS). The issues of concern include a wide dynamic range of numbers, choice of normalization, high effective Schmidt number of soot particles, and realizability of the soot particle size distribution function (PSDF). These problems are not unique to DNS, but they are often exacerbated by the high-order numerical schemes used in …

Field Implementation Of Phanerochaete Chrysosporium Biomass Pretreatment: Fungal Identification And Inoculation Techniques, Bobby D. Carey Jr

Theses and Dissertations--Biosystems and Agricultural Engineering

Scaling biological pretreatment from the bench scale to the production scale may be more economical if unsterilized feedstock are used, however these allow for microbial competition from contaminates. An accurate and rapid method for identifying the desired biological pretreatment organism is necessary to confirm the presence of the desired organism when contaminates are morphologically similar to the target organism. Traditional methods, such as visual identification, sequencing, and selective plating can be time consuming and are sometimes still inconclusive. Based on methods described in the literature, plasmid DNA containing the marker genes gus (�-glucuronidase), LacZ, and gfp (green fluorescence protein) …

Characterization Of W-Ti-O Thin Films For Application In Photovoltaics, Amanda Patricia Christmas

Open Access Theses & Dissertations

Photovoltaic (PV) devices consist of the conversion of light energy into electricity. Nearly all PV technologies employ transparent conducting oxides (TCO) as an integral part of the de-vice structure so that the light can reach the semiconductor. The predominant transparent conducting oxide (TCO) that is currently being used in industry is indium tin oxide (ITO). However, Indium (In) is high in cost and becoming scarce in the world. This work is focused towards Titanium doped Tungsten oxide (WO3) for TCO application. The ultimate goal is making novel, cheaper, and efficient TCOs based on W-Ti-O films. Titanium will enhance the conductivity …

Integral Precast Girder-To-Cap Connections For Accelerated Bridge Construction In Seismic Regions, Justin Vander Werff

Faculty Work Comprehensive List

Accelerated bridge construction (ABC) is increasingly desired and needed, due to the aging transportation infrastructure across the United States and the always-growing demand placed on our nation’s highway system. Precast concrete is a common way to incorporate ABC techniques. Advantages over typical cast-in-place concrete methods include speed of field construction, improved quality control, and decrease in detoured traffic during construction, among others. However, precast concrete structures have not been used to their full potential in high seismic regions, due to the deficiency of precast concrete connections in past earthquake events. The California Department of Transportation (Caltrans) is eager to incorporate …

Translation Of 'Seasons Of Life: A Panoramic Selection Of Songs By Rabindranath Tagore', Monish Ranjan Chatterjee

Electrical and Computer Engineering Faculty Publications

No abstract provided.

Development Of A Tribometer To Characterize Lubrication Layer Properties Of Self-Consolidating Concrete, Dimitri Feys, Kamal Khayat, Aurelien Perez-Schell, Rami Khatib

Civil, Architectural and Environmental Engineering Faculty Research & Creative Works

The Last Decade, Significant Advances Have Been Made in Investigating, Understanding and Predicting the Flow Characteristics during Pumping of Concrete. Kaplan Developed Theoretical Equations based on the Rheological and Tribological Properties of Concrete to Predict Pumping Pressures. Several Tribometers Were Developed to Characterize the Flow Properties of Concrete Along a Smooth Wall, But None of Them Allows the Use of Highly Workable Concretes. the Main Reason is that for the Calculation of the Yield Stress and Viscous Constant of the Lubrication Layer, the Concrete is Not Allowed to Be Sheared. in This Paper, a New Design for the Concrete Tribometer …