Computer Sciences Commons^™

Using Internet Artifacts To Profile A Child Pornography Suspect, Marcus K. Rogers, Kathryn C. Seigfried-Spellar

Journal of Digital Forensics, Security and Law

Digital evidence plays a crucial role in child pornography investigations. However, in the following case study, the authors argue that the behavioral analysis or “profiling” of digital evidence can also play a vital role in child pornography investigations. The following case study assessed the Internet Browsing History (Internet Explorer Bookmarks, Mozilla Bookmarks, and Mozilla History) from a suspected child pornography user’s computer. The suspect in this case claimed to be conducting an ad hoc law enforcement investigation. After the URLs were classified (Neutral; Adult Porn; Child Porn; Adult Dating sites; Pictures from Social Networking Profiles; Chat Sessions; Bestiality; Data Cleaning; …

On Cyber Attacks And Signature Based Intrusion Detection For Modbus Based Industrial Control Systems, Wei Gao, Thomas H. Morris

Journal of Digital Forensics, Security and Law

Industrial control system communication networks are vulnerable to reconnaissance, response injection, command injection, and denial of service attacks. Such attacks can lead to an inability to monitor and control industrial control systems and can ultimately lead to system failure. This can result in financial loss for control system operators and economic and safety issues for the citizens who use these services. This paper describes a set of 28 cyber attacks against industrial control systems which use the MODBUS application layer network protocol. The paper also describes a set of standalone and state based intrusion detection system rules which can be …

Idiographic Digital Profiling: Behavioral Analysis Based On Digital Forensics, Chad M. Steel

Journal of Digital Forensics, Security and Law

Idiographic digital profiling (IDP) is the application of behavioral analysis to the field of digital forensics. Previous work in this field takes a nomothetic approach to behavioral analysis by attempting to understand the aggregate behaviors of cybercriminals. This work is the first to take an idiographic approach by examining a particular subject's digital footprints for immediate use in an ongoing investigation. IDP provides a framework for investigators to analyze digital behavioral evidence for the purposes of case planning, subject identification, lead generation, obtaining and executing warrants, and prosecuting offenders.

On Identities In Modern Networks, Libor Polcak, Radek Hranick, Tomas Martınek

Journal of Digital Forensics, Security and Law

Communicating parties inside computer networks use different kind of identifiers. Some of these identifiers are stable, e.g., logins used to access a specific service, some are only temporary, e.g., dynamically assigned IP addresses. This paper tackles several challenges of lawful interception that emerged in modern networks. The main contribution is the graph model that links identities learnt from various sources distributed in a network. The inferred identities result into an interception of more detailed data in conformance with the issued court order. The approach deals with network address translation, short-lived identifiers and simultaneous usage of different identities. The approach was …

Exploring Forensic Implications Of The Fusion Drive, Shruti Gupta, Marcus Rogers

Journal of Digital Forensics, Security and Law

This paper explores the forensic implications of Apple’s Fusion Drive. The Fusion Drive is an example of auto-tiered storage. It uses a combination of a flash drive and a magnetic drive. Data is moved between the drives automatically to maximize system performance. This is different from traditional caches because data is moved and not simply copied. The research included understanding the drive structure, populating the drive, and then accessing data in a controlled setting to observe data migration strategies. It was observed that all the data is first written to the flash drive with 4 GB of free space always …

Multi-Stakeholder Case Prioritization In Digital Investigations, Joshua I. James

Journal of Digital Forensics, Security and Law

This work examines the problem of case prioritization in digital investigations for better utilization of limited criminal investigation resources. Current methods of case prioritization, as well as observed prioritization methods used in digital forensic investigation laboratories are examined. After, a multi-stakeholder approach to case prioritization is given that may help reduce reputational risk to digital forensic laboratories while improving resource allocation. A survey is given that shows differing opinions of investigation priority between Law Enforcement and the public that is used in the development of a prioritization model. Finally, an example case is given to demonstrate the practicality of the …

An Efficient Similarity Digests Database Lookup – A Logarithmic Divide & Conquer Approach, Frank Breitinger, Christian Rathgeb, Harald Baier

Journal of Digital Forensics, Security and Law

Investigating seized devices within digital forensics represents a challenging task due to the increasing amount of data. Common procedures utilize automated file identification, which reduces the amount of data an investigator has to examine manually. In the past years the research field of approximate matching arises to detect similar data. However, if n denotes the number of similarity digests in a database, then the lookup for a single similarity digest is of complexity of O(n). This paper presents a concept to extend existing approximate matching algorithms, which reduces the lookup complexity from O(n) to O(log(n)). Our proposed approach is based …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

From The Editor, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

In this issue we have three papers that have made the cut. The first paper titled “The Cost of Privacy: Riley v. California’s Impact on Cell Phone Searches” is timely. In 2014 there was a unanimous decision that requires a warrant for all cell phone searches. This has some strong implications on the forensic analysis of mobile phones, and to that end, this article discusses and summarizes this legal precedent with its practical implications.

Leveraging Decentralization To Extend The Digital Evidence Acquisition Window: Case Study On Bittorrent Sync, Mark Scanlon, Jason Farina, Nhien A. Khac, Tahar Kechadi

Journal of Digital Forensics, Security and Law

File synchronization services such as Dropbox, Google Drive, Microsoft OneDrive, Apple iCloud, etc., are becoming increasingly popular in today’s always-connected world. A popular alternative to the aforementioned services is BitTorrent Sync. This is a decentralized/cloudless file synchronization service and is gaining significant popularity among Internet users with privacy concerns over where their data is stored and who has the ability to access it. The focus of this paper is the remote recovery of digital evidence pertaining to files identified as being accessed or stored on a suspect’s computer or mobile device. A methodology for the identification, investigation, recovery and verification …

Book Review: The X-Ways Forensics Practitioner's Guide, Linda Lau

Journal of Digital Forensics, Security and Law

Brett Shavers is a former law enforcement officer, a digital forensics examiner, an adjunct instructor, and a frequent speaker at many conferences. After writing his first book, titled Placing the Suspect Behind the Keyboard: Using Digital Forensics and Investigative Techniques to Identify Cybercrime Suspects, he co-wrote his 2nd book with Eric Zimmerman and Jimmy Weg, who is a knowledgeable technical editor. Both Brett and Eric are experts in cyber forensics, with many years of law enforcement experience at both the state and federal levels.

The Cost Of Privacy: Riley V. California’S Impact On Cell Phone Searches, Jennifer L. Moore, Jonathan Langton, Joseph Pochron

Journal of Digital Forensics, Security and Law

Riley v. California is the United States Supreme Court’s first attempt to regulate the searches of cell phones by law enforcement. The 2014 unanimous decision requires a warrant for all cell phone searches incident to arrest absent an emergency. This work summarizes the legal precedent and analyzes the limitations and practical implications of the ruling. General guidelines for members of the criminal justice system at all levels consistent with the Supreme Court’s decision are provided.

Quantifying Relevance Of Mobile Digital Evidence As They Relate To Case Types: A Survey And A Guide For Best Practice, Shahzad Saleem, Ibrahim Baggili, Oliver Popov

Journal of Digital Forensics, Security and Law

In this work, a survey was conducted to help quantify the relevance of nineteen types of evidence (such as SMS) to seven types of digital investigations associated with mobile devices (MD) (such as child pornography). 97 % of the respondents agreed that every type of digital evidence has a different level of relevance to further or solve a particular investigation. From 55 serious participants, a dataset of 5,772 responses regarding the relevance of nineteen types of digital evidence for all the seven types of digital investigations was obtained. The results showed that (i) SMS belongs to the most relevant type …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Developing A Conceptual Framework For Modeling Deviant Cyber Flash Mob: A Socio-Computational Approach Leveraging Hypergraph Constructs, Samer Al-Khateeb, Nitin Agarwal

Journal of Digital Forensics, Security and Law

In a Flash Mob (FM) a group of people get together in the physical world perform an unpredicted act and disperse quickly. Cyber Flash Mob (CFM) is the cyber manifestation of flash mob coordinated primarily using social media. Deviant Cyber Flash Mob (or, DCFM) is a special case of CFM, which is categorized as the new face of transnational crime organizations (TCOs). The DCFM phenomenon can be considered as a form of a cyber-collective action that is defined as an action aiming to improve group’s conditions (such as, status or power). In this paper, we conduct a conceptual analysis of …

Neutrosophic Logic Approaches Applied To ”Rabot” Real Time Control, Alexandru Gal, Luige Vladareanu, Florentin Smarandache, Hongnian Yu, Mincong Deng

Branch Mathematics and Statistics Faculty and Staff Publications

In this paper we present a way of deciding which control law should operate at a time for a mobile walking robot. The proposed deciding method is based on the new research field, called Neutrosophic Logic. The results are presented as a simulated system for which the output is related to the inputs according to the Neutrosophic Logic.

Building A Scalable And High-Performance Key-Value Store System, Yuehai Xu

Wayne State University Dissertations

Contemporary web sites can store and process very large amounts of data. To provide timely service to their users, they have adopted key-value (KV) stores, which is a simple but effective caching infrastructure atop the conventional databases that store these data, to boost performance. Examples are Facebook, Twitter and Amazon. As yet little is known about the realistic workloads outside of the companies that operate them, this dissertation work provides a detailed workload study on Facebook's Memcached, which is one of the world's largest KV deployment. We analyze the Memcached workload from the perspective of server-side performance, request composition, caching …

Solving A New Bi-Objective Joint Replenishment Inventory Model With Modified Rand And Genetic Algorithms, Ommolbanin Yousefi, Seyed Jafar Sadjadi

Turkish Journal of Electrical Engineering and Computer Sciences

There are many cases in real inventory systems where more than one objective must be optimized. The main purpose of this research is to develop a multiobjective joint replenishment problem (JRP), where one objective is the minimization of the total inventory investment and another is the minimization of the total inventory ordering and holding costs. To solve the suggested model, 3 algorithms are proposed. In the first algorithm, the existing RAND method, called the best heuristic for solving the JRP, is modified and a new heuristic algorithm is developed to be applicable to the JRP with 2 objectives. The second …

Contrast Enhancement Using Linear Image Combinations Algorithm (Ceulica) For Enhancing Brain Magnetic Resonance Images, Burak Yilmaz, Yüksel Özbay

Turkish Journal of Electrical Engineering and Computer Sciences

Brain magnetic resonance imaging (MRI) images support important information about brain diseases for physicians. Morphological alterations in brain tissues indicate the probable existence of a disease in many cases. Proper estimation of these tissues, measuring their sizes, and analyzing their image patterns are parts of the diagnosis process. Therefore, the interpretability and perceptibility level of the MRI image is valuable for physicians. In this paper, a new image contrast enhancement algorithm based on linear combinations is presented. The proposed algorithm is focused on improving the interpretability and perceptibility of the image information. An MRI image is presented to the algorithm, …

Online Feature Selection And Classification With Incomplete Data, Habi̇l Kalkan

Turkish Journal of Electrical Engineering and Computer Sciences

This paper presents a classification system in which learning, feature selection, and classification for incomplete data are simultaneously carried out in an online manner. Learning is conducted on a predefined model including the class-dependent mean vectors and correlation coefficients, which are obtained by incrementally processing the incoming observations with missing features. A nearest neighbor with a Gaussian mixture model, whose parameters are also estimated from the trained model, is used for classification. When a testing observation is received, the algorithm discards the missing attributes on the observation and ranks the available features by performing feature selection on the model that …

Model-Free Controller With An Observer Applied In Real-Time To A 3-Dof Helicopter, Ahsene Boubakir, Salim Labiod, Fares Boudjema, Franck Plestan

Turkish Journal of Electrical Engineering and Computer Sciences

In this paper, a model-free controller with an observer is presented for a class of uncertain continuous-time multiinput-multioutput nonlinear dynamic systems. The proposed model-free control law consists of 2 parts: the first part is a linear control term used to specify the dynamics of the closed loop system, and the second part is a compensator of the effects of uncertainties and external disturbances. The compensator is synthesized from an estimator of the effects of uncertainties and disturbances based on the Lyapunov approach. In order to estimate the unavailable states of the controlled system, a linear state observer is designed. All …

A User-Oriented Network Forensic Analyser: The Design Of A High-Level Protocol Analyser, D Joy, F Li, N L. Clarke, S M. Furnell

Australian Digital Forensics Conference

Network forensics is becoming an increasingly important tool in the investigation of cyber and computer-assisted crimes. Unfortunately, whilst much effort has been undertaken in developing computer forensic file system analysers (e.g. Encase and FTK), such focus has not been given to Network Forensic Analysis Tools (NFATs). The single biggest barrier to effective NFATs is the handling of large volumes of low-level traffic and being able to exact and interpret forensic artefacts and their context – for example, being able extract and render application-level objects (such as emails, web pages and documents) from the low-level TCP/IP traffic but also understand how …

Combating Integrity Attacks In Industrial Control Systems, Chad Arnold

Browse all Theses and Dissertations

Industrial Control Systems are vulnerable to integrity attacks because of connectivity to the external Internet and trusted internal networking components that can become compromised. Integrity attacks can be modeled, analyzed, and sometimes remedied by exploiting properties of physical devices and reasoning about the trust worthiness of ICS communication components.

Industrial control systems (ICS) monitor and control the processes of public utility that society depends on - the electric power grid, oil and gas pipelines, transportation, and water facilities. Attacks that impact the operations of these critical assets could have devastating consequences. The complexity and desire to interconnect ICS components have …

A Novel Synergistic Model Fusing Electroencephalography And Functional Magnetic Resonance Imaging For Modeling Brain Activities, Konstantinos Michalopoulos

Browse all Theses and Dissertations

Study of the human brain is an important and very active area of research. Unraveling the way the human brain works would allow us to better understand, predict and prevent brain related diseases that affect a significant part of the population. Studying the brain response to certain input stimuli can help us determine the involved brain areas and understand the mechanisms that characterize behavioral and psychological traits.

In this research work two methods used for the monitoring of brain activities, Electroencephalography (EEG) and functional Magnetic Resonance (fMRI) have been studied for their fusion, in an attempt to bridge together the …

Automated Complexity-Sensitive Image Fusion, Brian Patrick Jackson

Browse all Theses and Dissertations

To construct a complete representation of a scene with environmental obstacles such as fog, smoke, darkness, or textural homogeneity, multisensor video streams captured in diferent modalities are considered. A computational method for automatically fusing multimodal image streams into a highly informative and unified stream is proposed. The method consists of the following steps: 1. Image registration is performed to align video frames in the visible band over time, adapting to the nonplanarity of the scene by automatically subdividing the image domain into regions approximating planar patches

2. Wavelet coefficients are computed for each of the input frames in each modality …

The Properties Of Property Alignment On The Semantic Web, Michelle Andreen Cheatham

Browse all Theses and Dissertations

Ontology alignment is an important step in enabling computers to query and reason across the many linked datasets on the semantic web. This is a difficult challenge because the ontologies underlying different linked datasets can vary in terms of subject area coverage, level of abstraction, ontology modeling philosophy, and even language. The alignment approach presented here centers on string similarity metrics. Nearly all ontology alignment systems use a string similarity metric in one form or another, but it seems that the choice of a particular metric is often arbitrary. We begin this dissertation with the most comprehensive survey to date …

Yeast Pheromone Pathway Modeling Using Petri Nets, Stephen D. Scott, Abhishek Majumdar, Jitender S. Deogun, Steven D. Harris

School of Computing: Conference and Workshop Papers

Background: Our environment is composed of biological components of varying magnitude. The relationships between the different biological elements can be represented as a biological network. The process of mating in S. cerevisiae is initiated by secretion of pheromone by one of the cells. Our interest lies in one particular question: how does a cell dynamically adapt the pathway to continue mating under severe environmental changes or under mutation (which might result in the loss of functionality of some proteins known to participate in the pheromone pathway). Our work attempts to answer this question. To achieve this, we first propose a …

A Comparison Of A Campus Cluster And Open Science Grid Platforms For Protein- Guided Assembly Using Pegasus Workflow Management System, Natasha Pavlovikj, Kevin Begcy, Sairam Behera, Malachy Campbell, Harkamal Walia, Jitender S. Deogun

School of Computing: Conference and Workshop Papers

Scientific workflows are a useful tool for managing large and complex computational tasks. Due to its intensive resource requirements, the scientific workflows are often executed on distributed platforms, including campus clusters, grids and clouds. In this paper we build a scientific workflow for blast2cap3, the protein-guided assembly, using the Pegasus Workflow Management System (Pegasus WMS). The modularity of blast2cap3 allows us to decompose the existing serial approach on multiple tasks, some of which can be run in parallel. Afterwards, this workflow is deployed on two distributed execution platforms: Sandhills, the University of Nebraska Campus Cluster, and the Open Science …

Transforming Web Tables To A Relational Database, David W. Embley, George Nagy, Sharad C. Seth

School of Computing: Conference and Workshop Papers

HTML tables represent a significant fraction of web data. The often complex headers of such tables are determined accurately using their indexing property. Isolated headers are factored to extract category hierarchies. Web tables are then transformed into a canonical form and imported into a relational database. The proposed processing allows for the formulation of arbitrary SQL queries over the collection of induced relational tables.

Cross-Domain Password-Based Authenticated Key Exchange Revisited, Liqun Chen, Hoon Wei Lim, Guomin Yang

Research Collection School Of Computing and Information Systems

We revisit the problem of secure cross-domain communication between two users belonging to different security domains within an open and distributed environment. Existing approaches presuppose that either the users are in possession of public key certificates issued by a trusted certificate authority (CA), or the associated domain authentication servers share a long-term secret key. In this article, we propose a generic framework for designing four-party password-based authenticated key exchange (4PAKE) protocols. Our framework takes a different approach from previous work. The users are not required to have public key certificates, but they simply reuse their login passwords, which they share …