Computer Engineering Commons^™

From The Editor-In-Chief, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

Welcome to JDFSL’s fourth and final issue for 2014! First, I would like to thank our editorial board, reviewers, and the JDFSL team for bringing this issue to life. It has been a big year for JDFSL as the journal continues to progress. I would like to highlight our critical achievements for 2014 before touching on the papers that were accepted in this issue: 1. JDFSL has gone to a fully open access model without author payment through support from academic institutions. 2. JDFSL has formed and continues to form partnerships with various conferences that relate to cyber security and …

Book Review: Judiciary-Friendly Forensics Of Software Copyright Infringement (Vinod Polpaya Bhattathiripad), Pedro L. P. Sanchez

Journal of Digital Forensics, Security and Law

Judiciary-Friendly Forensics of Software Copyright Infringement is a book by Dr. Vinod Polpaya Bhattathiripad, published by IGI-Global as part of its Research Essentials series. The book discusses the forensics of software copyright infringement and highlights theoretical, functional, and procedural matters in the investigation of copyright infringement of software products, as well as the development of forensic technologies to detect and avoid software piracy. It is of interest to software forensic experts, lawyers in the field of copyright infringement, judges, software professionals, and students.

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Personal Denial Of Service (Pdos) Attacks: A Discussion And Exploration Of A New Category Of Cyber Crime, Michael R. Bartolacci, Larry J. Leblanc, Ashley Podhradsky

Journal of Digital Forensics, Security and Law

The growth of the Internet has created a corresponding growth in Internet-based crimes and online misbehavior, particularly among younger computer-savvy people. Younger generations have grown up in a world where internet access, social networking, e-commerce and smartphones are commonplace. Given this fact, they have learned how to use, and how to abuse, technology. This leads us to define a new category of cybercrime called a Personal Denial of Service attack (PDOS). A PDOS is a cyber-crime in which an individual deliberately prevents the access of another individual or small group to online services such as email or banking. Due to …

File Detection On Network Traffic Using Approximate Matching, Frank Breitinger, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

In recent years, Internet technologies changed enormously and allow faster Internet connections, higher data rates and mobile usage. Hence, it is possible to send huge amounts of data / files easily which is often used by insiders or attackers to steal intellectual property. As a consequence, data leakage prevention systems (DLPS) have been developed which analyze network traffic and alert in case of a data leak. Although the overall concepts of the detection techniques are known, the systems are mostly closed and commercial. Within this paper we present a new technique for network traffic analysis based on approximate matching (a.k.a …

Fast Rtp Detection And Codecs Classification In Internet Traffic, Petr Matousek, Ondrej Rysavy, Martin Kmet

Journal of Digital Forensics, Security and Law

This paper presents a fast multi-stage method for on-line detection of RTP streams and codec identification of transmitted voice or video traffic. The method includes an RTP detector that filters packets based on specific values from UDP and RTP headers. When an RTP stream is successfully detected, codec identification is applied using codec feature sets. The paper shows advantages and limitations of the method and its comparison with other approaches. The method was implemented as a part of network forensics framework NetFox developed in project SEC6NET. Results show that the method can be successfully used for Lawful Interception as well …

Relating Admissibility Standards For Digital Evidence To Attack Scenario Reconstruction, Changwei Liu, Anoop Singhal, Duminda Wijesekera

Journal of Digital Forensics, Security and Law

Attackers tend to use complex techniques such as combining multi-step, multi-stage attack with anti-forensic tools to make it difficult to find incriminating evidence and reconstruct attack scenarios that can stand up to the expected level of evidence admissibility in a court of law. As a solution, we propose to integrate the legal aspects of evidence correlation into a Prolog based reasoner to address the admissibility requirements by creating most probable attack scenarios that satisfy admissibility standards for substantiating evidence. Using a prototype implementation, we show how evidence extracted by using forensic tools can be integrated with legal reasoning to reconstruct …

Audit: Automated Disk Investigation Toolkit, Umit Karabiyik, Sudhir Aggarwal

Journal of Digital Forensics, Security and Law

Software tools designed for disk analysis play a critical role today in forensics investigations. However, these digital forensics tools are often difficult to use, usually task specific, and generally require professionally trained users with IT backgrounds. The relevant tools are also often open source requiring additional technical knowledge and proper configuration. This makes it difficult for investigators without some computer science background to easily conduct the needed disk analysis. In this paper, we present AUDIT, a novel automated disk investigation toolkit that supports investigations conducted by non-expert (in IT and disk technology) and expert investigators. Our proof of concept design …

Evidentiary Power And Propriety Of Digital Identifiers And The Impact On Privacy Rights In The United States, Michael Losavio, Deborah Keeling

Journal of Digital Forensics, Security and Law

Media and network systems capture and store data about electronic activity in new, sometimes unprecedented ways; computational systems make for new means of analysis and knowledge development. These new forms offer new, powerful tactical tools for investigations of electronic malfeasance under traditional legal regulation of state power, particular that of Fourth Amendment limitations on police searches and seizures under the U.S. Constitution. But autonomy, identity and authenticity concerns with electronic data raise issues of public policy, privacy and proper police oversight of civil society. We examine those issues and their implications for digital and computational forensics

Effects Of The Factory Reset On Mobile Devices, Riqui Schwamm, Neil C. Rowe

Journal of Digital Forensics, Security and Law

Mobile devices usually provide a “factory-reset” tool to erase user-specific data from the main secondary storage. 9 Apple iPhones, 10 Android devices, and 2 BlackBerry devices were tested in the first systematic evaluation of the effectiveness of factory resets. Tests used the Cellebrite UME-36 Pro with the UFED Physical Analyzer, the Bulk Extractor open-source tool, and our own programs for extracting metadata, classifying file paths, and comparing them between images. Two phones were subjected to more detailed analysis. Results showed that many kinds of data were removed by the resets, but much user-specific configuration data was left. Android devices did …

Testing Framework For Mobile Device Forensics Tools, Maxwell Anobah, Shahzad Saleem, Oliver Popov

Journal of Digital Forensics, Security and Law

The proliferation of mobile communication and computing devices, in particular smart mobile phones, is almost paralleled with the increasing number of mobile device forensics tools in the market. Each mobile forensics tool vendor, on one hand claims to have a tool that is best in terms of performance, while on the other hand each tool vendor seems to be using different standards for testing their tools and thereby defining what support means differently. To overcome this problem, a testing framework based on a series of tests ranging from basic forensics tasks such as file system reconstruction up to more complex …

Technical Soddi Defenses: The Trojan Horse Defense Revisited, Chad M. Steel

Journal of Digital Forensics, Security and Law

In 2004, the Trojan horse defense was at a crossroads, having been successfully employed in two child pornography cases in the United Kingdom, resulting in acquittals. Despite the early successes, the Trojan horse defense has failed to become a regularly employed strategy. The original Trojan horse defense has now become part of the more general technical SODDI (Some Other Dude Did It) defense, which includes the possibility of unknown actors using unsecured Wi-Fi connections or having physical access to a computer to perform criminal acts. In the past ten years, it has not been effective in the United States for …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

A State-Of-The-Art Review Of Cloud Forensics, Sameera Almulla, Youssef Iraqi, Andrew Jones

Journal of Digital Forensics, Security and Law

Cloud computing and digital forensics are emerging fields of technology. Unlike traditional digital forensics where the target environment can be almost completely isolated, acquired and can be under the investigators control; in cloud environments, the distribution of computation and storage poses unique and complex challenges to the investigators. Recently, the term “cloud forensics” has an increasing presence in the field of digital forensics. In this state-of-the-art review, we included the most recent research efforts that used “cloud forensics” as a keyword and then classify the literature into three dimensions: (1) survey-based, (2) technology-based and (3) forensics-procedural-based. We discuss widely accepted …

Understanding Computer Forensics Requirements In China Via The “Panda Burning Incense” Virus Case, Frank Law, K. P. Chow, Y. H. Mai

Journal of Digital Forensics, Security and Law

In March 2012, Mainland China has amended its Criminal Procedure Law, which includes the introduction of a new type of evidence, i.e., digital evidence, to the court of law. To better understand the development of computer forensics and digital evidence in Mainland China, this paper discusses the Chinese legal system in relation to digital investigation and how the current legal requirements affect the existing legal and technical usage of digital evidence at legal proceedings. Through studying the famous “Panda Burning Incense (Worm.WhBoy.cw)” virus case that happened in 2007, this paper aims to provide a better understanding of how to properly …

Forensics Of Software Copyright Infringement Crimes: The Modern Posar Test Juxtaposed With The Dated Afc Test, Vinod P. Bhattathiripad

Journal of Digital Forensics, Security and Law

This paper presents a new development in the forensics of software copyright through a juxtaposed comparison between the proven AFC test and the recent POSAR test, the two forensic procedures for establishing software copyright infringement cases. First, the paper separately overviews the 3-stage, linear sequential AFC test and then the 5-phase, cyclic POSAR test (as AFC’s logical extension). The paper then compares the processes involved in each of the 5 phases of the POSAR test with the processes involved in the 3 stages in the AFC test, for the benefit of forensic practitioners and researchers. Finally, the paper discusses some …

Fighting Child Pornography: A Review Of Legal And Technological Developments, Jasmine V. Eggestein, Kenneth J. Knapp

Journal of Digital Forensics, Security and Law

In our digitally connected world, the law is arguably behind the technological developments of the Internet age. While this causes many issues for law enforcement, it is of particular concern in the area of child pornography in the United States. With the wide availability of technologies such as digital cameras, peer-to-peer file sharing, strong encryption, Internet anonymizers and cloud computing, the creation and distribution of child pornography has become more widespread. Simultaneously, fighting the growth of this crime has become more difficult. This paper explores the development of both the legal and technological environments surrounding digital child pornography. In doing …

A Study Of Forensic Imaging In The Absence Of Write-Blockers, Gary C. Kessler, Gregory H. Carlton

Journal of Digital Forensics, Security and Law

Best practices in digital forensics demand the use of write-blockers when creating forensic images of digital media, and this has been a core tenet of computer forensics training for decades. The practice is so ingrained that the integrity of images created without a write-blocker are immediately suspect. This paper describes a research framework that compares forensic images acquired with and without utilizing write-blockers in order to understand the extent of the differences, if any, in the resultant forensic copies. We specifically address whether differences are superficial or evidentiary, and we discuss the impact of admitting evidence acquired without write blocking. …

Automated Evaluation Of Approximate Matching Algorithms On Real Data, Frank Breitinger, Vassil Roussev

Electrical & Computer Engineering and Computer Science Faculty Publications

Bytewise approximate matching is a relatively new area within digital forensics, but its importance is growing quickly as practitioners are looking for fast methods to screen and analyze the increasing amounts of data in forensic investigations. The essential idea is to complement the use of cryptographic hash functions to detect data objects with bytewise identical representation with the capability to find objects with bytewise similarrepresentations.

Unlike cryptographic hash functions, which have been studied and tested for a long time, approximate matching ones are still in their early development stages and evaluation methodology is still evolving. Broadly, prior approaches have …

Analysis Of Bfsa Based Anti-Collision Protocol In Lf, Hf, And Uhf Rfid Environments, Varun Bhogal

UNF Graduate Theses and Dissertations

Over the years, RFID (radio frequency identification) technology has gained popularity in a number of applications. The decreased cost of hardware components along with the recognition and implementation of international RFID standards have led to the rise of this technology.

One of the major factors associated with the implementation of RFID infrastructure is the cost of tags. Low frequency (LF) RFID tags are widely used because they are the least expensive. The drawbacks of LF RFID tags include low data rate and low range. Most studies that have been carried out focus on one frequency band only. This thesis presents …

Solving A New Bi-Objective Joint Replenishment Inventory Model With Modified Rand And Genetic Algorithms, Ommolbanin Yousefi, Seyed Jafar Sadjadi

Turkish Journal of Electrical Engineering and Computer Sciences

There are many cases in real inventory systems where more than one objective must be optimized. The main purpose of this research is to develop a multiobjective joint replenishment problem (JRP), where one objective is the minimization of the total inventory investment and another is the minimization of the total inventory ordering and holding costs. To solve the suggested model, 3 algorithms are proposed. In the first algorithm, the existing RAND method, called the best heuristic for solving the JRP, is modified and a new heuristic algorithm is developed to be applicable to the JRP with 2 objectives. The second …

Contrast Enhancement Using Linear Image Combinations Algorithm (Ceulica) For Enhancing Brain Magnetic Resonance Images, Burak Yilmaz, Yüksel Özbay

Turkish Journal of Electrical Engineering and Computer Sciences

Brain magnetic resonance imaging (MRI) images support important information about brain diseases for physicians. Morphological alterations in brain tissues indicate the probable existence of a disease in many cases. Proper estimation of these tissues, measuring their sizes, and analyzing their image patterns are parts of the diagnosis process. Therefore, the interpretability and perceptibility level of the MRI image is valuable for physicians. In this paper, a new image contrast enhancement algorithm based on linear combinations is presented. The proposed algorithm is focused on improving the interpretability and perceptibility of the image information. An MRI image is presented to the algorithm, …

Online Feature Selection And Classification With Incomplete Data, Habi̇l Kalkan

Turkish Journal of Electrical Engineering and Computer Sciences

This paper presents a classification system in which learning, feature selection, and classification for incomplete data are simultaneously carried out in an online manner. Learning is conducted on a predefined model including the class-dependent mean vectors and correlation coefficients, which are obtained by incrementally processing the incoming observations with missing features. A nearest neighbor with a Gaussian mixture model, whose parameters are also estimated from the trained model, is used for classification. When a testing observation is received, the algorithm discards the missing attributes on the observation and ranks the available features by performing feature selection on the model that …

Model-Free Controller With An Observer Applied In Real-Time To A 3-Dof Helicopter, Ahsene Boubakir, Salim Labiod, Fares Boudjema, Franck Plestan

Turkish Journal of Electrical Engineering and Computer Sciences

In this paper, a model-free controller with an observer is presented for a class of uncertain continuous-time multiinput-multioutput nonlinear dynamic systems. The proposed model-free control law consists of 2 parts: the first part is a linear control term used to specify the dynamics of the closed loop system, and the second part is a compensator of the effects of uncertainties and external disturbances. The compensator is synthesized from an estimator of the effects of uncertainties and disturbances based on the Lyapunov approach. In order to estimate the unavailable states of the controlled system, a linear state observer is designed. All …

On The Security Of Auditing Mechanisms For Secure Cloud Storage, Yong Yu, Lei Niu, Guomin Yang, Yi Mu, Willy Susilo

Research Collection School Of Computing and Information Systems

Cloud computing is a novel computing model that enables convenient and on-demand access to a shared pool of configurable computing resources. Auditing services are highly essential to make sure that the data is correctly hosted in the cloud. In this paper, we investigate the active adversary attacks in three auditing mechanisms for shared data in the cloud, including two identity privacy-preserving auditing mechanisms called Oruta and Knox, and a distributed storage integrity auditing mechanism.We show that these schemes become insecure when active adversaries are involved in the cloud storage. Specifically, an active adversary can arbitrarily alter the cloud data without …

Measuring And Modelling The Thermal Performance Of The Tamar Suspension Bridge Using A Wireless Sensor Network, Nicholas De Battista, James M. W. Brownjohn, Hwee-Pink Tan, Ki Young Koo

Research Collection School Of Computing and Information Systems

A study on the thermal performance of the Tamar Suspension Bridge deck in Plymouth, UK, is presented in this paper. Ambient air, suspension cable, deck and truss temperatures were acquired using a wired sensor system. Deck extension data were acquired using a two-hop wireless sensor network. Empirical models relating the deck extension to various combinations of temperatures were derived and compared. The most accurate model, which used all the four temperature variables, predicted the deck extension with an accuracy of 99.4%. Time delays ranging from 10 to 66 min were identified between the daily cycles of the air temperature and …

Using Software-Based Decision Procedures To Control Instruction-Level Execution, William B. Kimball

AFIT Patents

An apparatus, method and program product are provided for securing a computer system. A digital signature of an application is checked, which is loaded into a memory of the computer system configured to contain memory pages. In response to finding a valid digital signature, memory pages containing instructions of the application are set as executable and memory pages other than those containing instructions of the application are set as non-executable. Instructions in executable memory pages are executed. Instructions in non-executable memory pages are prevented from being executed. A page fault is generated in response to an attempt to execute an …

Data Management In Cloud Environments: Nosql And Newsql Data Stores, Katarina Grolinger, Wilson A. Higashino, Abhinav Tiwari, Miriam Am Capretz

Electrical and Computer Engineering Publications

: Advances in Web technology and the proliferation of mobile devices and sensors connected to the Internet have resulted in immense processing and storage requirements. Cloud computing has emerged as a paradigm that promises to meet these requirements. This work focuses on the storage aspect of cloud computing, specifically on data management in cloud environments. Traditional relational databases were designed in a different hardware and software era and are facing challenges in meeting the performance and scale requirements of Big Data. NoSQL and NewSQL data stores present themselves as alternatives that can handle huge volume of data. Because of the …

Reduced Row Echelon Form And Non-Linear Approximation For Subspace Segmentation And High-Dimensional Data Clustering, Akram Aldroubi, Ali Sekmen

Computer Science Faculty Research

Given a set of data W={w1,…,wN}∈RD drawn from a union of subspaces, we focus on determining a nonlinear model of the form U=⋃i∈ISi, where {Si⊂RD}i∈I is a set of subspaces, that is nearest to W. The model is then used to classify W into clusters. Our approach is based on the binary reduced row echelon form of data matrix, combined with an iterative scheme based on a non-linear approximation method. We prove that, in absence of noise, our approach can find the number of subspaces, their dimensions, and an orthonormal basis for each subspace Si. We provide a comprehensive analysis …

Situational Awareness/Triage Tool For Use In A Chemical, Biological, Radiological Nuclear Explosive (Cbrne) Environment, John N. Scarlett, Heather L. Gallup, David A. Smith

AFIT Patents

A method of managing patient care and emergency response following a Chemical, Biological, Radiological, or Nuclear Explosive (CBRNE) attack and maintaining compliance with the Health Insurance Portability and Accountability Act (HIPAA). The method including identifying each patient with a unique patient identifier, the identifier based upon the geospatial location of the patient, the geospatial location including at least the latitude and longitude of the patient when first treated, the unique patient identifier being part of patient data. Providing a collection point of patient data to form a patient data database where in the patient location data may be used to …