Aviation Commons^™

Wban Security Management In Healthcare Enterprise Environments, Karina Bahena, Manghui Tu

Annual ADFSL Conference on Digital Forensics, Security and Law

As healthcare data are pushed online, consumers have raised big concerns on the breach of their personal information. Law and regulations have placed businesses and public organizations under obligations to take actions to prevent such data breaches. Various vulnerabilities have been identified in healthcare enterprise environments, in which the Wireless Body Area Networks (WBAN) remains to be a major vulnerability, which can be easily taken advantage of by determined adversaries. Thus, vulnerabilities of WBAN systems and the effective countermeasure mechanisms to secure WBAN are urgently needed. In this research, first, the architecture of WBAN system has been explored, and the …

Forensics Analysis Of Privacy Of Portable Web Browsers, Ahmad Ghafarian

Annual ADFSL Conference on Digital Forensics, Security and Law

Web browser vendors offer a portable web browser option which is considered as one of the features that provides user privacy. Portable web browser is a browser that can be launched from a USB flash drive without the need for its installation on the host machine. Most popular web browsers have portable versions of their browsers as well. Portable web browsing poses a great challenge to computer forensic investigators who try to reconstruct the past browsing history, in case of any computer incidence. This research examines various sources in the host machine such as physical memory, temporary, recent, event files, …

Reverse Engineering A Nit That Unmasks Tor Users, Matthew Miller, Joshua Stroschein, Ashley Podhradsky

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper is a case study of a forensic investigation of a Network Investigative Technique (NIT) used by the FBI to deanonymize users of a The Onion Router (Tor) Hidden Service. The forensic investigators were hired by the defense to determine how the NIT worked. The defendant was ac- cused of using a browser to access illegal information. The authors analyzed the source code, binary files and logs that were used by the NIT. The analysis was used to validate that the NIT collected only necessary and legally authorized information. This paper outlines the publicly available case details, how the …

Malware In The Mobile Device Android Environment, Diana Hintea, Robert Bird, Andrew Walker

Annual ADFSL Conference on Digital Forensics, Security and Law

exploit smartphone operating systems has exponentially expanded. Android has become the main target to exploit due to having the largest install base amongst the smartphone operating systems and owing to the open access nature in which application installations are permitted. Many Android users are unaware of the risks associated with a malware infection and to what level current malware scanners protect them. This paper tests how efficient the currently available malware scanners are. To achieve this, ten representative Android security products were selected and tested against a set of 5,560 known and categorized Android malware samples. The tests were carried …

Forensic Analysis Of Smartphone Applications For Privacy Leakage, Diana Hintea, Chrysanthi Taramonli, Robert Bird, Rezhna Yusuf

Annual ADFSL Conference on Digital Forensics, Security and Law

Smartphone and tablets are personal devices that have diffused to near universal ubiquity in recent years. As Smartphone users become more privacy-aware and -conscious, research is needed to understand how “leakage” of private information (personally identifiable information – PII) occurs. This study explores how leakage studies in Droid devices should be adapted to Apple iOS devices. The OWASP Zed Attack Proxy (ZAP) is examined for 50 apps in various categories. This study confirms that: (1) most apps transmit unencrypted sensitive PII, (2) SSL is used by some recipient websites, but without corresponding app compliance with SSL, and (3) most apps …

Inferring Previously Uninstalled Applications From Residual Partial Artifacts, Jim Jones, Tahir Khan, Kathryn Laskey, Alex Nelson, Mary Laamanen, Douglas White

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper, we present an approach and experimental results to suggest the past presence of an application after the application has been uninstalled and the system has remained in use. Current techniques rely on the recovery of intact artifacts and traces, e.g., whole files, Windows Registry entries, or log file entries, while our approach requires no intact artifact recovery and leverages trace evidence in the form of residual partial files. In the case of recently uninstalled applications or an instrumented infrastructure, artifacts and traces may be intact and complete. In most cases, however, digital artifacts and traces are al- …

One-Time Pad Encryption Steganography System, Michael J. Pelosi, Gary Kessler, Michael Scott S. Brown

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper we introduce and describe a novel approach to adaptive image steganography which is combined with One-Time Pad encryption, and demonstrate the software which implements this methodology. Testing using the state-of-the-art steganalysis software tool StegExpose concludes the image hiding is reliably secure and undetectable using reasonably-sized message payloads (≤25% message bits per image pixel; bpp). Payload image file format outputs from the software include PNG, BMP, JP2, JXR, J2K, TIFF, and WEBP. A variety of file output formats is empirically important as most steganalysis programs will only accept PNG, BMP, and possibly JPG, as the file inputs.

Keywords: …

Applying Grounded Theory Methods To Digital Forensics Research, Ahmed Almarzooqi, Andrew Jones, Richard Howley

Annual ADFSL Conference on Digital Forensics, Security and Law

Deciding on a suitable research methodology is challenging for researchers. In this paper, grounded theory is presented as a systematic and comprehensive qualitative methodology in the emergent field of digital forensics research. This paper applies grounded theory in a digital forensics research project undertaken to study how organisations build and manage digital forensics capabilities. This paper gives a step-by-step guideline to explain the procedures and techniques of using grounded theory in digital forensics research. The paper gives a detailed explanation of how the three grounded theory coding methods (open, axial, and selective coding) can be used in digital forensics research. …

Covert6: A Tool To Corroborate The Existence Of Ipv6 Covert Channels, Raymond A. Hansen, Lourdes Gino, Dominic Savio

Annual ADFSL Conference on Digital Forensics, Security and Law

Covert channels are any communication channel that can be exploited to transfer information in a manner that violates the system’s security policy. Research in the field has shown that, like many communication channels, IPv4 and the TCP/IP protocol suite have been susceptible to covert channels, which could be exploited to leak data or be used for anonymous communications. With the introduction of IPv6, researchers are acutely aware that many vulnerabilities of IPv4 have been remediated in IPv6. However, a proof of concept covert channel system was demonstrated in 2006. A decade later, IPv6 and its related protocols have undergone major …

Acceleration Of Statistical Detection Of Zero-Day Malware In The Memory Dump Using Cuda-Enabled Gpu Hardware, Igor Korkin, Iwan Nesterow

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper focuses on the anticipatory enhancement of methods of detecting stealth software. Cyber security detection tools are insufficiently powerful to reveal the most recent cyber-attacks which use malware. In this paper, we will present first an idea of the highest stealth malware, as this is the most complicated scenario for detection because it combines both existing anti-forensic techniques together with their potential improvements. Second, we will present new detection methods which are resilient to this hidden prototype. To help solve this detection challenge, we have analyzed Windows’ memory content using a new method of Shannon Entropy calculation; methods of …

Using Computer Behavior Profiles To Differentiate Between Users In A Digital Investigation, Shruti Gupta, Marcus Rogers

Annual ADFSL Conference on Digital Forensics, Security and Law

Most digital crimes involve finding evidence on the computer and then linking it to a suspect using login information, such as a username and a password. However, login information is often shared or compromised. In such a situation, there needs to be a way to identify the user without relying exclusively on login credentials. This paper introduces the concept that users may show behavioral traits which might provide more information about the user on the computer. This hypothesis was tested by conducting an experiment in which subjects were required to perform common tasks on a computer, over multiple sessions. The …

Current Challenges And Future Research Areas For Digital Forensic Investigation, David Lillis, Brett A. Becker, Tadhg O’Sullivan, Mark Scanlon

Annual ADFSL Conference on Digital Forensics, Security and Law

Given the ever-increasing prevalence of technology in modern life, there is a corresponding increase in the likelihood of digital devices being pertinent to a criminal investigation or civil litigation. As a direct consequence, the number of investigations requiring digital forensic expertise is resulting in huge digital evidence backlogs being encountered by law enforcement agencies throughout the world. It can be anticipated that the number of cases requiring digital forensic analysis will greatly increase in the future. It is also likely that each case will require the analysis of an increasing number of devices including computers, smartphones, tablets, cloud-based services, Internet …

Forensic Analysis Of Ares Galaxy Peer-To-Peer Network, Frank Kolenbrander, Nhien-An Le-Khac, Tahar Kechadi

Annual ADFSL Conference on Digital Forensics, Security and Law

Child Abuse Material (CAM) is widely available on P2P networks. Over the last decade several tools were made for 24/7 monitoring of peer-to-peer (P2P) networks to discover suspects that use these networks for downloading and distribution of CAM. For some countries the amount of cases generated by these tools is so great that Law Enforcement (LE) just cannot handle them all. This is not only leading to backlogs and prioritizing of cases but also leading to discussions about the possibility of disrupting these networks and sending warning messages to potential CAM offenders. Recently, investigators are reporting that they are creating …

Keynote Speaker, Chuck Easttom

Annual ADFSL Conference on Digital Forensics, Security and Law

Conference Keynote Speaker, Chuck Easttom

Enterprise Network Design And Implementation For Airports, Ashraf H. Ali

Information Technology Master Theses

The aim of this project was airports network design and implementation and the introduction of a suitable network for most airports around the world. The following project focused on three main parts: security, quality, and safety. The project has been provided with different utilities to introduce a network with a high security level for the airport. These utilities are hardware firewalls, an IP access control list, Mac address port security, a domain server and s proxy server. All of these utilities have been configured to provide a secure environment for the entire network and to prevent hackers from entering sensitive …

Forecast Verification Of The Current Icing Potential (Cip) To Predict Lightning Hazards At U.S. Spaceports, Robert Edward Haley

Doctoral Dissertations and Master's Theses

Government spaceports employ extensive lightning detection networks that may not be available at commercial spaceports. Therefore, the Federal Aviation Administration identified the need for diagnosing the threat of triggered lightning without in-situ measurements. Anecdotal observations of the Aviation Weather Center’s Current Icing Potential (CIP) diagnostic model indicated a potentially high correlation between lightning activity and icing potential. A forecast verification study and supporting representative case studies were conducted to quantify the CIP’s ability to diagnose existing lightning hazards. The study showed that high positive statistical correlations between the CIP and lightning activity do exist, but so do negative correlations. During …

General Solution Of The Wind Triangle Problem And The Critical Tailwind Angle, Nihad E. Daidzic

Aviation Department Publications

A general analytical solution of the navigational wind-triangle problem and the calculation of the critical tailwind angle are presented in this study among other findings. Any crosswind component will effectively create a headwind component on fixed course tracks. The meaning of a route track is lost with excessive crosswinds representing the bifurcation point between the possible and the impossible navigational solutions. Any wind of constant direction and speed will effectively reduce groundspeed and increase time-of-flight on closed-loop multi-segment flights. Effective wind track component consists, in general, of true and induced components. The average groundspeed of multiple-leg flights is a harmonic …

Development Of Cloud-Based Uav Monitoring And Management System, Mason Itkin, Mihui Kim, Younghee Park

Faculty Publications

Unmanned aerial vehicles (UAVs) are an emerging technology with the potential to revolutionize commercial industries and the public domain outside of the military. UAVs would be able to speed up rescue and recovery operations from natural disasters and can be used for autonomous delivery systems (e.g., Amazon Prime Air). An increase in the number of active UAV systems in dense urban areas is attributed to an influx of UAV hobbyists and commercial multi-UAV systems. As airspace for UAV flight becomes more limited, it is important to monitor and manage many UAV systems using modern collision avoidance techniques. In this paper, …

The Tornado That Struck Embry-Riddle Aeronautical University On Christmas Day, 2006: Lessons Learned From A Near-Miss, John M. Lanicci

Journal of Aviation/Aerospace Education & Research

An F2 tornado that touched down in Daytona Beach on Christmas Day afternoon caused over $50 million of damage to the Embry-Riddle Aeronautical University campus and nearby neighborhoods. The tornado was part of a severe-weather outbreak over Florida, Georgia, and South Carolina that began during the overnight hours of 25 December 2006. Examination of surface and upper-level meteorological charts and vertical soundings on the morning of 25 December showed stability and wind-shear conditions favorable for tornadic thunderstorms over this region. The evolution of the squall line that moved through east-central Florida, and the parent thunderstorm that produced the tornado was …

Determination Of Rejected Landing Roll Runway Point-Of-No-Return And Go-Around In Transport Category Airplanes, Nihad E. Daidzic, Ph.D., Sc.D.

International Journal of Aviation, Aeronautics, and Aerospace

The decelerate-accelerate-takeoff maneuver in transport category airplanes has been discussed. Mathematical model based on total energy conservation has been used to calculate the rejected landing point-of-no-return on a runway which will still enable the airplane to safely execute go-around and achieve regulatory screen heights and takeoff safety speeds. After this point has been exceeded or below the point-of-no-return speed no go-around should ever be considered. Landing long and fast and/or decelerating on slippery runways may very well result in an overrun which could be prevented if the go-around is attempted before reaching this critical runway point. The point-of-no-return on the …

Momentum Of Particles From Time-Of-Flight Measurements, Joseph Best

Senior Theses

In order to find the momentum of particles from time of flight measurements, I used a program called Geant4 to simulate experiments. I made a simple two detector setup, and I recreated a real world experiment. I spent a lot of time learning to code in C++ so I could use Geant4 correctly. I simulated these experiments shooting electrons, muons, and pions through the geometry and measured the time at two points in their flight. Subtracting the second time from the first gave me the time of flight distribution for each particle. I used ROOT to draw histograms of the …

A Forecasting Tool For Predicting Australia's Domestic Airline Passenger Demand Using A Genetic Algorithm, Panarat Srisaeng, Glenn Baxter, Steven Richardson, Graham Wild

Research outputs 2014 to 2021

This study has proposed and empirically tested for the first time genetic algorithm optimization models for modelling Australia’s domestic airline passenger demand, as measured by enplaned passengers (GAPAXDE model) and revenue passenger kilometres performed (GARPKSDE model). Data was divided into training and testing datasets; 74 training datasets were used to estimate the weighting factors of the genetic algorithm models and 13 out-of-sample datasets were used for testing the robustness of the genetic algorithm models. The genetic algorithm parameters used in this study comprised population size (n): 200; the generation number: 1,000; and mutation rate: 0.01. The modelling results have shown …

Aviation Bird Hazard In Nexrad Dual Polarization Weather Radar Confirmed By Visual Observations, Bradley M. Muller, Frederick R. Mosher, Christopher G. Herbster, Anthony T. Brickhouse

International Journal of Aviation, Aeronautics, and Aerospace

Birds represent a significant hazard to flying aircraft as illustrated by the “Miracle on the Hudson” encounter in 2009 between U.S. Airways Flight 1549 and a flock of Canada Geese, forcing the flight to ditch in the river. Birds are common in the skies over Florida during the spring migration season, and often appear in the National Weather Service’s (NWS) NEXRAD weather radar imagery as an easily recognizable signature known as a “roost ring.” This paper presents a NEXRAD roost ring case in central Florida in a rare instance where the signatures were confirmed by visual observations of the birds. …

Global Optimized Isothermal And Nonlinear Models Of Earth’S Standard Atmosphere, Nihad E. Daidzic, Ph.D.,

International Journal of Aviation, Aeronautics, and Aerospace

Both, a global isothermal temperature model and a nonlinear quadratic temperature model of the ISA was developed and presented here. Constrained optimization techniques in conjunction with the least-square-root approximations were used to design best-fit isothermal models for ISA pressure and density changes up to 47 geopotential km for NLPAM, and 86 orthometric km for ISOAM respectively. The mass of the dry atmosphere and the relevant fractional-mass scale heights have been computed utilizing the very accurate eight-point Gauss-Legendre numerical quadrature for both ISOAM and NLPAM. Both, the ISOAM and the NLPAM represent viable alternatives to ISA in many practical applications and …

Bio-Fuel Alternatives In South African Airways (Saa) Operations - Is It An Effective Response To Vulnerability Over Carbon Taxes And Penalty?, Daniel Kwasi Adjekum

International Journal of Aviation, Aeronautics, and Aerospace

The paper did a comparative analysis of the carbon emission and European Union Emission Trading Surcharges (EU ETS) of South African Airways (SAA) current fleet that used aviation jet A1 fuel and the same fleet if it had used a 25% bio-fuel ‘drop in’ for the European routes within the first quarter of the 2014 flying year (FY 14). Operational data in terms of the flight scheduled, aircraft type, total time enroute, route stage length, passenger estimates were obtained through SAA’s flight operations website. An independent t–test was conducted to compare means of the emissions. The mean carbon dioxide …

Bio-Fuel Alternatives In South African Airways (Saa) Operations - Is It An Effective Response To Vulnerability Over Carbon Taxes And Penalty?, Daniel Kwasi Adjekum

Aviation Faculty Publications

The paper did a comparative analysis of the carbon emission and European Union Emission Trading Surcharges (EU ETS) of South African Airways (SAA) current fleet that used aviation jet A1 fuel and the same fleet if it had used a 25% bio-fuel ‘drop in’ for the European routes within the first quarter of the 2014 flying year (FY 14). Operational data in terms of the flight scheduled, aircraft type, total time enroute, route stage length, passenger estimates were obtained through SAA’s flight operations website. An independent t–test was conducted to compare means of the emissions. The mean carbon dioxide …

Tracking Criminals On Facebook: A Case Study From A Digital Forensics Reu Program, Daniel Weiss, Gary Warner

Annual ADFSL Conference on Digital Forensics, Security and Law

The 2014 Digital Forensics Research Experience for Undergraduates (REU) Program at the University of Alabama at Birmingham (UAB) focused its summer efforts on tracking criminal forums and Facebook groups. The UAB-REU Facebook team was provided with a list of about 60 known criminal groups on Facebook, with a goal to track illegal information posted in these groups and ultimately store the information in a searchable database for use by digital forensic analysts. Over the course of about eight weeks, the UAB-REU Facebook team created a database with over 400 Facebook groups conducting criminal activity along with over 100,000 unique users …

Towards A Digital Forensics Competency-Based Program: Making Assessment Count, Rose Shumba

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper describes an approach that UMUC has initiated to revise its graduate programs to a Competency-Based Education (CBE) curriculum. The approach, which is Learning Demonstration (LD) centric, includes the identification of learning goals and competences, identification and description of the LDs, mapping of the LDs to the competences, scripting the LDs, placing the LDs into the respective courses, validating the developed materials, and the development of the open learning resources. Programs in the Cybersecurity and Information Assurance Department, including the Digital Forensics and Cyber Investigations program, are being revised. An LD centric approach to curriculum development helps align programs …

Phishing Intelligence Using The Simple Set Comparison Tool, Jason Britt, Alan Sprague, Gary Warner

Annual ADFSL Conference on Digital Forensics, Security and Law

Phishing websites, phish, attempt to deceive users into exposing their passwords, user IDs, and other sensitive information by imitating legitimate websites, such as banks, product vendors, and service providers. Phishing investigators need fast automated tools to analyze the volume of phishing attacks seen today. In this paper, we present the Simple Set Comparison tool. The Simple Set Comparison tool is a fast automated tool that groups phish by imitated brand allowing phishing investigators to quickly identify and focus on phish targeting a particular brand. The Simple Set Comparison tool is evaluated against a traditional clustering algorithm over a month's worth …

Identifying Common Characteristics Of Malicious Insiders, Nan Liang, David Biros

Annual ADFSL Conference on Digital Forensics, Security and Law

Malicious insiders account for large proportion of security breaches or other kinds of loss for organizations and have drawn attention of both academics and practitioners. Although methods and mechanism have been developed to monitor potential insider via electronic data monitoring, few studies focus on predicting potential malicious insiders. Based on the theory of planned behavior, certain cues should be observed or expressed when an individual performs as a malicious insider. Using text mining to analyze various media content of existing insider cases, we strive to develop a method to identify crucial and common indicators that an individual might be a …