Computer Sciences Commons^™

Education For Cyber Crime Investigators, David Greer, Joe Mulenex, John Hale, Gavin W. Manes

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital forensics and cyber crime investigations are continually growing, rapidly changing fields requiring law enforcement agencies to meet very rigorous training requirements. New opportunities for committing criminal activity against persons, organization or property are presented every day with the proliferation of personal digital devices, computers, the internet, computer networks, and automated data systems. Whether the crime involves attacks against computer systems, electronic information, or more traditional crimes such as murder, money laundering or fraud, electronic evidence is becoming more prevalent. It is no surprise that law enforcement and criminal justice officials are being overwhelmed by the volume of investigations and …

Computer Geolocation Using Extracted Features, Chad M.S. Steel

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper compares the extracted feature data from a sample set of hard drive images in an effort to relate the features to the physical location of the drive. A list of probable zip codes, phone numbers, place names, and IP addresses are extracted from raw drive images and compared to manually identified geolocation data. The results of the individual extractions are then analyzed to determine the feasibility in using automated extraction and analysis techniques for geolocating hard drives.

Keywords: hard disk forensics, geocoding, geolocation

Defending Against Insider Use Of Digital Steganography, James E. Wingate, Glenn D. Watt, Marc Kurtz, Chad W. Davis, Robert Lipscomb

Annual ADFSL Conference on Digital Forensics, Security and Law

The trusted insider is among the most harmful and difficult to detect threats to information security, according to the Federal Plan for Information Assurance and Cyber Security Research and Development released in April 2006. By default, employees become trusted insiders when granted the set of privileges needed to do their jobs, which typically includes access to the Internet. It is generally presumed the insiders are loyally working to achieve the organization’s goals and objectives and would not abuse the privileges given to them. However, some insiders will inevitably abuse some of their privileges. For example, a trusted insider might abuse …

Investigating Information Structure Of Phishing Emails Based On Persuasive Communication Perspective, Ki Jung Lee, Il-Yeol Song

Annual ADFSL Conference on Digital Forensics, Security and Law

Current approaches of phishing filters depend on classifying messages based on textually discernable features such as IP-based URLs or domain names as those features that can be easily extracted from a given phishing message. However, in the same sense, those easily perceptible features can be easily manipulated by sophisticated phishers. Therefore, it is important that universal patterns of phishing messages should be identified for feature extraction to serve as a basis for text classification. In this paper, we demonstrate that user perception regarding phishing message can be identified in central and peripheral routes of information processing. We also present a …

Monitoring And Surveillance In The Workplace: Lessons Learnt? – Investigating The International Legal Position, Verine Etsebeth

Annual ADFSL Conference on Digital Forensics, Security and Law

When considering the legal implications of monitoring and surveillance in the workplace, the question may be asked why companies deploy computer surveillance and monitoring in the first place. Several reasons may be put forward to justify why more than 80% of all major American firms monitor employee e-mails and Internet usage. However, what most companies forget is the fact that the absence or presence of monitoring and surveillance activities in a company holds serious legal consequences for companies. From the discussion in this paper it will become apparent that there is a vast difference in how most countries approach this …

The Gap Between Theory And Practice In Digital Forensics, Joseph C. Sremack

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital forensics is a young field that is being defined by the reactive nature of its development – in terms of both research and practice. As technology develops, digital forensics is forced to react and adapt. The rapid development of technology and the lack of an established theoretical foundation has led to a disconnect between the theory and practice of digital forensics. While the base theoretical issues are being worked on by researchers, practitioners are dealing with entirely new sets of issues. The complexity of investigations is increasing, and anti-forensics techniques are advancing as well. The disconnect will be resolved …

An Exploratory Analysis Of Computer Mediated Communications On Cyberstalking Severity, Stephen D. Barnes, David P. Biros

Annual ADFSL Conference on Digital Forensics, Security and Law

The interaction between disjunctive interpersonal relationships, those where the parties to the relationship disagree on the goals of the relationship, and the use of computer mediated communications channels is a relatively unexplored domain. Bargh (2002) suggests that CMC channels can amplify the development of interpersonal relationships, and notes that the effect is not constant across communications activities. This proposal suggests a line of research that explores the interaction between computer mediated communications (CMC) and stalking, which is a common form of disjunctive relationships. Field data from cyberstalking cases will be used to look at the effects of CMC channels on …

Guideline Model For Digital Forensic Investigation, Salma Abdalla, Sherif Hazem, Sherif Hashem

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper proposes a detailed guideline model for digital forensics; the proposed model consists of five main phases, Preparation phase, Physical Forensics and Investigation Phase, Digital Forensics Phase, Reporting and Presentation Phase, and Closure Phase.

Most of the existing models in this field do not cover all aspects of digital forensic investigations, as they focus mainly on the processing of digital evidence or on the legal points. Although they gave good information to base on it a guide, but they are not detailed enough to describe fully the investigative process in a way that can be used by investigators during …

New Federal Rules And Digital Evidence, Gavin W. Manes, Elizabeth Downing, Lance Watson, Christopher Thrutchley

Annual ADFSL Conference on Digital Forensics, Security and Law

The newly revised Federal Rules of Civil Procedure and developments under the Federal Rules of Evidence have a significant impact on the use, collection, and treatment of digital evidence for legal proceedings. The Rules now formally grant electronic documents and digital evidence the same status as paper and other forms of tangible evidence. As a result, the availability and proper preservation of potentially relevant electronic evidence must be considered, at the very latest, in the preliminary stages of litigation and, at the earliest, as soon as litigation is reasonably anticipated. It is important for professionals to be familiar with the …

The General Digital Forensics Model, Steven Rigby, Marcus K. Rogers

Annual ADFSL Conference on Digital Forensics, Security and Law

The lack of a graphical representation of all of the principles, processes, and phases necessary to carry out an digital forensic investigation is a key inhibitor to effective education in this newly emerging field of study. Many digital forensic models have been suggested for this purpose but they lack explanatory power as they are merely a collection of lists or one-dimensional figures. This paper presents a new multi-dimensional model, the General Digital Forensics Model (GDFM), that shows the relationships and inter-connectedness of the principles and processes needed within the domain of digital forensics.

Keywords: process model, computer forensics, expert learning, …

Teams Responsibilities For Digital Forensic Process, Salma Abdalla, Sherif Hazem, Sherif Hashem

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper presents a detailed digital forensics process model and the responsible teams to perform it. The discussed model presents three teams and a forensic leader who coordinate between the three teams; these teams are physical crime scene team, laboratory examination team and courtroom team. These teams are responsible of achieving the digital forensic model by applying five main phases which are preparation phase, physical forensics and investigation phase, digital forensics phase, reporting and presentation phase and closure phase.

Most of the existing models in this field are either theoretical that deals with data processing or based on a legal …

The Evolution Of Internet Legal Regulation In Addressing Crime And Terrorism, Murdoch Watney

Annual ADFSL Conference on Digital Forensics, Security and Law

Internet regulation has evolved from self-regulation to the criminalization of conduct to state control of information available, accessed and submitted. Criticism has been leveled at the different forms of state control and the methods employed to enforce state control. After the terrorist attack on the USA on 11 September 2001, governments justify Internet state control as a law enforcement and national security tool against the abuse and misuse of the Internet for the commission of serious crimes, such as phishing, child pornography; terrorism and copyright infringement. Some Internet users and civil rights groups perceive state control as an abomination which …

Long-Range Target Classification In A Cluttered Environment Using Multi-Sensor Image Sequences, Cenk Yaman

Electrical & Computer Engineering Theses & Dissertations

Accurate identification of unknown contacts is crucial in military intelligence. Automated systems which quickly and accurately determine the identity of a contact could be a benefit in backing up electronic signal identification methods such as Identification Friend and Foe (IFF) systems. Radio Detection and Ranging (RADAR) images are often undesirable in military applications since they reveal the location of the imaging system. So we explore the use of visible and infrared images of which are generally more consistent than RADAR images and for which it is easy to compensate for environmental effects. Recent advances in visible and IR imaging technology …

Performance Analysis Of Ieee 802.11b Devices In The Presence Of Interference Aware Scheduling-Adaptive Frequency Hopping Enabled Bluetooth Devices, Deepthi Gopalpet

Electrical & Computer Engineering Theses & Dissertations

Wireless Local Area networks (WLAN) and Wireless Personal Area Networks (WPAN) provide complimentary services using the same unlicensed radio frequency band of operation. The 802.11b WLAN operates in the 2.4 GHz band and uses a Direct Sequence Spread Spectrum technique. It is designed to cover large areas ranging up to 100 meters in diameter, which may connect hundreds of computers. Bluetooth (BT) WPAN also operates in the same frequency band as the IEEE 802.lib and it uses a Frequency Hopping Spread Spectrum technique. BT is primarily used for communications between notebooks, palm units and other personal computing devices within relatively …

A Resolution Enhancement Technique In Digital Images, Mehmet R. Ormanoglu

Electrical & Computer Engineering Theses & Dissertations

Image enhancement is the processing of images to increase their usefulness. The image enhancement methods and objectives vary with the application. When images are enhanced for human viewers, as in television, the objective is mostly to improve perceptual aspects: image quality, intelligibility, or visual appearance. The aim of this research work is to make the processed image better in the visual sense than the unprocessed image. An image can often be enhanced by modifying its contrast or dynamic range, increasing the sharpness of edges, reducing the noise, or reducing the blurring. The most commonly used contrast enhancement technique is histogram …

Steganalysis Feature Improvement Using Expectation Maximization, Benjamin M. Rodriguez, Gilbert L. Peterson, Sos S. Agaian

Faculty Publications

No abstract provided.

Stochastic Estimation And Control Of Queues Within A Computer Network, Nathan C. Stuckey

Theses and Dissertations

An extended Kalman filter is used to estimate size and packet arrival rate of network queues. These estimates are used by a LQG steady state linear perturbation PI controller to regulate queue size within a computer network. This paper presents the derivation of the transient queue behavior for a system with Poisson traffic and exponential service times. This result is then validated for ideal traffic using a network simulated in OPNET. A more complex OPNET model is then used to test the adequacy of the transient queue size model when non-Poisson traffic is combined. The extended Kalman filter theory is …

Improvement To The Data Logging Capability Of A Cough Monitoring System, Matthew Barlow

Inquiry: The University of Arkansas Undergraduate Research Journal

Data logging capability of a previously developed self contained cough recorder using an accelerometer as the sensing element is improved by using a secure digital memory card for later retrieval on a computer. Firmware is developed to enhance the functionality of the cough recorder. Existing libraries are modified for increased write rates. Increased writing speed allows 8-bit sampling at rates exceeding 8kHz, allowing for detailed time and frequency domain analysis. Additional features have also been developed to enable easy management of recordings, such as a file system compatibility with Microsoft Windows., and unique file names for each recording.

Securitycom: A Multi-Player Game For Researching And Teaching Information Security Teams, Douglas P. Twitchell

Journal of Digital Forensics, Security and Law

A major portion of government and business organizations’ attempts to counteract information security threats is teams of security personnel. These teams often consist of personnel of diverse backgrounds in specific specialties such as network administration, application development, and business administration, resulting in possible conflicts between security, functionality, and availability. This paper discusses the use of games to teach and research information security teams and outlines research to design and build a simple, team-oriented, configurable, information security game. It will be used to study how information security teams work together to defend against attacks using a multi-player game, and to study …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Neural Network Controller Development And Implementation For Spark Ignition Engines With High Egr Levels, Jonathan B. Vance, Atmika Singh, Brian C. Kaul, Jagannathan Sarangapani, J. A. Drallmeier

Electrical and Computer Engineering Faculty Research & Creative Works

Past research has shown substantial reductions in the oxides of nitrogen (NOx) concentrations by using 10% -25% exhaust gas recirculation (EGR) in spark ignition (SI) engines (see Dudek and Sain, 1989). However, under high EGR levels, the engine exhibits strong cyclic dispersion in heat release which may lead to instability and unsatisfactory performance preventing commercial engines to operate with high EGR levels. A neural network (NN)-based output feedback controller is developed to reduce cyclic variation in the heat release under high levels of EGR even when the engine dynamics are unknown by using fuel as the control input. A separate …

Two Neural Network Based Decentralized Controller Designs For Large Scale Power Systems, Wenxin Liu, Jagannathan Sarangapani, Ganesh K. Venayagamoorthy, Donald C. Wunsch, Mariesa Crow, David A. Cartes

Electrical and Computer Engineering Faculty Research & Creative Works

This paper presents two neural network (NN) based decentralized controller designs for large scale power systems' generators, one is for the excitation control and the other is for the steam valve control. Though the control signals are calculated using local signals only, the transient and overall system stabilities can be guaranteed. NNs are used to approximate the unknown and/or imprecise dynamics of the local power system and the interconnection terms, thus the requirements for exact system parameters are released. Simulation studies with a three machine power system demonstrate the effectiveness of the proposed controller designs.

An Ad Hoc Adaptive Hashing Technique For Non-Uniformly Distributed Ip Address Lookup In Computer Networks, Christopher Martinez, Wei-Ming Lin

Electrical & Computer Engineering and Computer Science Faculty Publications

Hashing algorithms have been widely adopted for fast address look-up, which involves a search through a database to find a record associated with a given key. Hashing algorithms transforms a key into a hash value hoping that the hashing renders the database a uniform distribution with respect to the hash value. The closer to uniform hash values, the less search time required for a query. When the database is key-wise uniformly distributed, any regular hashing algorithm (bit-extraction, bit-group XOR, etc.) leads to a statistically perfect uniform hash distribution. When the database has keys with a non-uniform distribution, performance of regular …

Providing A Foundation For Analysis Of Volatile Data Stores, Timothy Vidas

Journal of Digital Forensics, Security and Law

Current threats against typical computer systems demonstrate a need for forensic analysis of memory-resident data in addition to the conventional static analysis common today. Certain attacks and types of malware exist solely in memory and leave little or no evidentiary information on nonvolatile stores such as a hard disk drive. The desire to preserve system state at the time of response may even warrant memory acquisition independent of perceived threats and the ability to analyze the acquired duplicate.

Tools capable of duplicating various types of volatile data stores are becoming widely available. Once the data store has been duplicated, current …

A New Relaying Algorithm To Detect Loss Of Excitation Of Synchronous Generators, Ömer Usta, M. H. Musa, M. Bayrak, M.A. Redfern

Turkish Journal of Electrical Engineering and Computer Sciences

A new digital relaying algorithm is introduced for the protection of synchronous generators against loss of excitation conditions. The new algorithm is based on measuring of the 3-phase reactive power output of the machines, and monitors the direction and magnitude of leading reactive power at the generator terminal. The protection algorithm is designed such that it can provide reliable protection against loss of field conditions and remains stable during recoverable power system swing conditions. While the new relay produces a trip signal for partial loss of field conditions causing the machine to lose its stability, it remains stable for the …

A Combinatorial Approach Of Real Ga & Fuzzy To Atc Enhancement, Hossein Farahmand, Masoud Rashidinejad, Ali Akbar Gharaveici

Turkish Journal of Electrical Engineering and Computer Sciences

Under new de-regulated environment an open access to transmission system seems to be desired. Transmission system operators (TSOs) are encouraged to use the existing facilities more efficiently. This paper focuses on study of the best location for SVC as a FACTS device to improve voltage profile as well as maximum available transfer capacity (ATC) in order to achieve lower prices. Real genetic algorithm (RGA) is used for optimization technique and analytical hierarchy process (AHP) associated with fuzzy sets to obtain priority vector for each alternative to evaluate the GA fitness. The effectiveness of the proposed methodology is shown through case …

Modelling A Deposition Process In Collective Construction, Robert L. Stewart, R. Andrew Russell, Lindsay Kleeman

Turkish Journal of Electrical Engineering and Computer Sciences

During collective construction tasks, swarm robots coordinate their actions in space and time to build structures that conform to some given design or specification. In this paper, a simulation model and a mathematical model (based on a Markov chain) are introduced to describe the deposition process of a previously detailed robotic swarm system that uses templates and feedback to facilitate construction. The models are based on the behaviour and geometry of real robots and predict the dynamics observed during practical trials as well as explaining the occurrence of different spatial patterns of building blocks. Furthermore, the models provide an insight …

Swarm Robot Systems Based On The Evolution Of Personality Traits, Sidney Nascimento Givigi Jr.

Turkish Journal of Electrical Engineering and Computer Sciences

Game theory may be very useful in modeling and analyzing swarms of robots. Using game theory in conjunction with traits of personalities, we achieve intelligent swarm robots. Traits of personality are characteristics of each robot that define the robots' behaviours. The environment is represented as a game and due to the evolution of the traits through a learning process, we show how the robots may react intelligently to changes in the environment. A proof of convergence for the proposed algorithm is offered. The process of selection of traits is discussed and the potential of the modeling is demonstrated in several …

Swarms In Biology And Engineering, Kevin M. Passino

Turkish Journal of Electrical Engineering and Computer Sciences

No abstract provided.

Spatial Diversity In Signal Strength Based Wlan Location Determination Systems, Anil Ramachandran, Jagannathan Sarangapani

Electrical and Computer Engineering Faculty Research & Creative Works

Literature indicates that spatial diversity can be utilized to compensate channel uncertainties such as multipath fading. Therefore, in this paper, spatial diversity is exploited for locating stationary and mobile objects in the indoor environment. First, space diversity technique is introduced for small scale motion and temporal variation compensation of received signal strength and it is demonstrated analytically that it enhances location accuracy. Small scale motion refers to movements of the transmitter and/or the receiver of the order of sub-wavelengths while temporal effects refer to environmental variations with time. A novel metric is introduced for selection combining in order to improve …