Computer Sciences Commons^™

A Forensic Study Of The Effectiveness Of Selected Anti-Virus Products Against Ssdt Hooking Rootkits, Sami Al-Shaheri, Dale Lindskog, Pavol Zavarsky, Ron Ruhl

Annual ADFSL Conference on Digital Forensics, Security and Law

For Microsoft Windows Operating Systems, both anti-virus products and kernel rootkits often hook the System Service Dispatch Table (SSDT). This research paper investigates the interaction between these two in terms of the SSDT. To investigate these matters, we extracted digital evidence from volatile memory, and studied that evidence using the Volatility framework. Due to the diversity in detection techniques used by the anti-virus products, and the diversity of infection techniques used by rootkits, our investigation produced diverse results, results that helped us to understand several SSDT hooking strategies, and the interaction between the selected anti-virus products and the rootkit samples. …

An Ontology-Based Forensic Analysis Tool, Mohammed Alzaabi, Andy Jones, Thomas A. Martin

Annual ADFSL Conference on Digital Forensics, Security and Law

The analysis of forensic investigation results has generally been identified as the most complex phase of a digital forensic investigation. This phase becomes more complicated and time consuming as the storage capacity of digital devices is increasing, while at the same time the prices of those devices are decreasing. Although there are some tools and techniques that assist the investigator in the analysis of digital evidence, they do not adequately address some of the serious challenges, particularly with the time and effort required to conduct such tasks. In this paper, we consider the use of semantic web technologies and in …

First Glance: An Introductory Analysis Of Network Forensics Of Tor, Raymond Hansen

Annual ADFSL Conference on Digital Forensics, Security and Law

The Tor network is a low-latency overlay network for TCP flows that is designed to provide privacy and anonymity to its users. It is currently in use by many as a means to avoid censorship of both information to be shared and information to be retrieved. This paper details the architecture of the Tor network as a platform for evaluating the current state of forensic analysis of the Tor network. Specific attempts to block access to the Tor network are examined to identify (a) the processes utilized to identify Tor nodes, and (b) the resulting exposure of potentially inculpatory evidence. …

A Thematic Review Of User Compliance With Information Security Policies Literature, David Sikolia

Annual ADFSL Conference on Digital Forensics, Security and Law

The adoption of computer and internet technology has greatly improved the way businesses operate. However the risk to the confidentiality, integrity and availability of organizational data and systems has greatly increased too. Information security is an ever present concern for all organizations. Financial estimates of the impact of security breaches to information and technology resources range from hundreds of billions to over one trillion dollars each year worldwide (D'Arcy et al., 2011b). Organizations have therefore developed a combination of technical, administrative, and physical controls to reduce this risk (D'Arcy et al., 2011a). Administrative measures include the development of information security …

Journey Into Windows 8 Recovery Artifacts, W. K. Johnson

Annual ADFSL Conference on Digital Forensics, Security and Law

One of the most difficult processes of digital forensics is to understand how new technology interacts with current technology and how digital forensic analysts can utilize current Digital Forensics technologies and processes to recover and find information hidden. Microsoft has released their new operating system Windows 8, with this new release Microsoft has added some features to the operating system that will present some interesting complications to digital forensics. Since the initial release of the Windows 8 Release Candidates there have been some research released that focus primarily on the new user created artifacts and a few artifacts that have …

An Image Forensic Scheme With Robust And Fragile Watermarking For Business Documents, Sai Ho Kwok

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper proposes an image forensic scheme with both robust and fragile watermarking techniques for business documents. Through a dual watermarking approach, the proposed scheme can achieve image forensics objectives of (a) identification of source; (b) authentication of documents; and (c) locating the tempered areas of documents due to attacks. An example is presented to prove the concepts of the proposed scheme.

Keywords: Image Forensics, Fragile and Robust Watermarking, Business Document.

Significance Of Semantic Reconciliation In Digital Forensics, Nickson M. Karie, H. S. Venter

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital forensics (DF) is a growing field that is gaining popularity among many computer professionals, law enforcement agencies and other stakeholders who must always cooperate in this profession. Unfortunately, this has created an environment replete with semantic disparities within the domain that needs to be resolved and/or eliminated. For the purpose of this study, semantic disparity refers to disagreements about the meaning, interpretation, descriptions and the intended use of the same or related data and terminologies. If semantic disparity is not detected and resolved, it may lead to misunderstandings. Even worse, since the people involved may not be from the …

System-Generated Digital Forensic Evidence In Graphic Design Applications, Enos Mabuto, Hein Venter

Annual ADFSL Conference on Digital Forensics, Security and Law

Graphic design applications are often used for the editing and design of digital art. The same applications can be used for creating counterfeit documents such as identity documents (IDs), driver’s licences, passports, etc. However, the use of any graphic design application leaves behind traces of digital information that can be used during a digital forensic investigation. Current digital forensic tools examine a system to find digital evidence, but they do not examine a system specifically for the creating of counterfeit documents created through the use of graphic design applications. The paper in hand reviews the system-generated digital forensic evidence gathered …

Money Laundering Detection Framework To Link The Disparate And Evolving Schemes, Murad Mehmet, Duminda Wijesekera, Miguel F. Buchholtz

Annual ADFSL Conference on Digital Forensics, Security and Law

Money launderers hide traces of their transactions with the involvement of entities that participate in sophisticated schemes. Money laundering detection requires unraveling concealed connections among multiple but seemingly unrelated human money laundering networks, ties among actors of those schemes, and amounts of funds transferred among those entities. The link among small networks, either financial or social, is the primary factor that facilitates money laundering. Hence, the analysis of relations among money laundering networks is required to present the full structure of complex schemes. We propose a framework that uses sequence matching, case-based analysis, social network analysis, and complex event processing …

Identifying Peer-To-Peer Traffic On Shared Wireless Networks, Simon Piel, Ej Jung

Annual ADFSL Conference on Digital Forensics, Security and Law

Tracing contraband downloads leads investigators to an IP address, and in turn Internet Service Providers (ISP) can provide a physical location using this IP address. However, most homes and offices share this IP address among many computers using wireless networks. In other words, there needs to be another investigation to find out which computer was responsible for contraband downloads. To make matters worse, these shared wireless networks often have vulnerabilities in access control such as using WEP or using weak passwords. In such cases, any computer in range, not necessarily at the given physical address, could be responsible. We use …

On Resolving The Cloud Forensics Conundrum, John Bagby

Annual ADFSL Conference on Digital Forensics, Security and Law

The “cloud” is idiom for an ill-defined set of online services. The cloud simultaneously offers IT savings and promises advances in functionality (e.g., ubiquity). However, the cloud also imposes poorly understood burdens on security and it may provoke injustice. Thus, the cloud presents a durable and seemingly irreconcilable conundrum for the digital forensics communit(ies). First, cloud proponents make efficiency promises for cloud services (SaaS, IaaS, PaaS). These translate well into the digital forensics domain. Indeed, the cloud may enable crowd sourcing of investigatory data vastly lowering costs of dispute resolution. For example, cloud-based litigation war rooms may reduce electronic discovery …

Cybercrime And Punishment: An Analysis Of The Deontological And Utilitarian Functions Of Punishment In The Information Age, Karim Jetha

Annual ADFSL Conference on Digital Forensics, Security and Law

This conceptual piece analyzes the role of criminal punishment and the nature of cyber crime to investigate whether the current punishment schemes are appropriate given the deontological and utilitarian goals of punishment: retribution, deterrence, incapacitation, and rehabilitation. The research has implications for policymaking in cybercriminal law.

Keywords: cybercrime, criminal law, punishment, retribution, deterrence, information economics

The Development Of Computer Forensic Legal System In China, Yonghao Mai, K. P. Chow, Rongsheng Xu, Gang Zhou, Fei Xu, Jun Zhang

Annual ADFSL Conference on Digital Forensics, Security and Law

The computer forensic discipline was established around 2000 in China, which was further developed along with Chinese judicial appraisal system in 2005. The new criminal and civil procedure laws of the People’s Republic of China was enacted on 1 Jan 2013. The new laws specified electronic data is legal evidence and has great impact on the current practice on handling electronic evidence. This paper introduces the electronic data and electronic evidence examination procedure in mainland China, the general concept of computer forensic legal system, the management of computer judicial experts, the management of computer judicial expertise institutions.

Keywords: China legal …

Equivalence Checking For High-Assurance Behavioral Synthesis, Kecheng Hao

Dissertations and Theses

The rapidly increasing complexities of hardware designs are forcing design methodologies and tools to move to the Electronic System Level (ESL), a higher abstraction level with better productivity than the state-of-the-art Register Transfer Level (RTL). Behavioral synthesis, which automatically synthesizes ESL behavioral specifications to RTL implementations, plays a central role in this transition. However, since behavioral synthesis is a complex and error-prone translation process, the lack of designers' confidence in its correctness becomes a major barrier to its wide adoption. Therefore, techniques for establishing equivalence between an ESL specification and its synthesized RTL implementation are critical to bring behavioral synthesis …

Coupled Flow Field Simulations Of Charring Ablators With Nonequilibrium Surface Chemistry, Hicham Alkandry, Iain D. Boyd, Alexandre Martin

Mechanical Engineering Faculty Publications

This paper describes the coupling of a Navier-Stokes solver to a material response code to simulate nonequilibrium gas-surface interactions. The Navier-Stokes solver used in this study is LeMANS, which is a three-dimensional computational fluid dynamics code that can simulate hypersonic reacting flows including thermo-chemical nonequilibrium effects. The material response code employed in this study is MOPAR, which uses the one-dimensional control volume nite-element method to model heat conduction and pyrolysis gas behavior. This coupling is demonstrated using a test case based on the Stardust sample return capsule. Coupled simulations are performed at three different trajectory conditions. The effects of the …

Volume Averaged Modeling Of The Oxidation Of Porous Carbon Fiber Material, Alexandre Martin

Mechanical Engineering Faculty Publications

Charring ablators remain the premium choice for space exploration missions that involve atmospheric re-entry. This type of ablative material is composed of a carbon matrix, usually made of fibers, which is then impregnated with a resin. During re-entry, the high heat flux produced by convective heating causes the material to chemically react. First, the resin pyrolyzes, and is vaporized into a gas that travels through the material, and is eventually ejected at the surface. Then, as the temperature rises, the surface of the porous matrix recess through ablative processes. For re-entry conditions typical of space exploration missions, this is mainly …

Multi-Dimensional Modeling Pyrolysis Gas Flow Inside Charring Ablators, Haoyue Weng, Alexandre Martin

Mechanical Engineering Faculty Publications

Using an ablative thermal/material response code, the importance of three-dimensionality for modeling ablative test-article is addressed. In particular, the simulation of the pyrolysis gas flow inside a porous material is presented, using two different geometries. The effects of allowing the gas to flow out of the side wall are especially highlighted. Results show that the flow inside the test-article is complex, and that the 0D or 1D assumption made in most Material Response (MR) codes might not be valid for certain geometries.

Inform 7 Usability Precompiler, Chad Robert Brantley, Timothy Phan

Computer Engineering

Inform 7 Usability Precompiler or I7UP is a project which helps Inform 7 authors with their stories by diversifying the possibilities in the author’s interactive fiction. I7UP reads and analyzes the Inform story that is passed in through python and natural language processing then provides the user with a selection of choices to add to his story and lastly automatically generates the corresponding Inform 7 code. By utilizing the combination of Python, Django, and HTML/CSS, I7UP is able to provide an easytouse interface which helps generate additional "Understand" statements and "Conjugated Verb" statements. I7UP is an authoring aid for Inform …

Channels: Easy Video Content Consumption, Alexander R. Ledwith

Computer Engineering

The idea for this project is to take a user’s digital movie and television show library, and organize the individual videos into lists that will continuously and concurrently play like cable TV channels. This means that when a list of channels is switched to, video content will automatically start playing, possibly in the middle, based on a schedule. It should serve the needs of the user by allowing the user to quickly watch any of their existing channels, easily add a new channel based on chosen criteria or manual selection, and easily add new video content. In addition, the product …

Protocases, Christopher M. Polis

Computer Engineering

Design and implementation of a 3D printing web application.

Integrated Collision Avoidance System Sensor Evaluation Final Design Project, Alex F. Graebe, Bridgette S. Kimball, Drew T. Lavoise

Mechanical Engineering

Following the development of Aircraft Collision Avoidance Technology (ACAT) by the National Aeronautics and Space Administration (NASA), a need arose to transition the life-saving technology to aid the general aviation community. Considering the realistic cost of implementation, it was decided that the technology should be adapted to function on any smartphone, using that device as an end-to-end solution to sense, process, and alert the pilot to imminent threats. In September of 2012, the SAS (Sense and Survive) Senior Project Team at California Polytechnic University (Cal Poly), San Luis Obispo was assigned the task of using smartphone technology to accurately sense …

A Generic Decision Making Framework For Autonomous Systems, Connor Lange

Master's Theses

With the rising popularity of small satellites, such as CubeSats, many smaller institutions previously incapable of developing and deploying a spacecraft have starting to do so. Institutions with a history of space flight, such as NASA JPL, have begun to put projects on CubeSats that would normally fly on much larger satellites. As a result, the institutions with space flight heritage have begun to port spacecraft software that was previously designed for much larger and more complex satellites to the CubeSat platform. Unfortunately for universities, who are the majority of all institutions devel- oping CubeSats, these ported systems are too …

Understanding Common Perceptions From Online Social Media, Derek Doran, Swapna S. Gokhale, Aldo Dagnino

Computer Science and Engineering Faculty Publications

Modern society habitually uses online social media services to publicly share observations, thoughts, opinions, and beliefs at any time and from any location. These geotagged social media posts may provide aggregate insights into people's perceptions on a bad range of topics across a given geographical area beyond what is currently possible through services such as Yelp and Foursquare. This paper develops probabilistic language models to investigate whether collective, topic-based perceptions within a geographical area can be extracted from the content of geotagged Twitter posts. The capability of the methodology is illustrated using tweets from three areas of different sizes. An …

Linear Model Estimation Of Nonlinear Systems Using Least-Squares Algorithm5, Alireza Rahrooh, Walter W. Buchanan, Remzi Seker

Publications

This paper presents utilizes Least-Squares Algorithm to obtain more accurate linear models of nonlinear systems using parameter estimation. This approach generates an optimal linear model which is valid over a wide range of trajectories and converges to the desired steady-state value with no errors unlike the existing techniques. The proposed technique is very efficient and does not require storing the data. Therefore, it can easily be used and implemented with limited resources for undergraduate curriculum especially in underdeveloped countries. Most available techniques for linearization of nonlinear system are only valid about the operating point; furthermore, the knowledge of the operating …

Modeling A Sensor To Improve Its Efficacy, Nabin K. Malakar, Daniil Gladkov, Kevin H. Knuth

Physics Faculty Scholarship

Robots rely on sensors to provide them with information about their surroundings. However, high-quality sensors can be extremely expensive and cost-prohibitive. Thus many robotic systems must make due with lower-quality sensors. Here we demonstrate via a case study how modeling a sensor can improve its efficacy when employed within a Bayesian inferential framework. As a test bed we employ a robotic arm that is designed to autonomously take its own measurements using an inexpensive LEGO light sensor to estimate the position and radius of a white circle on a black field. The light sensor integrates the light arriving from a …

Extending Technology Roadmap Through Fuzzy Cognitive Map-Based Scenarios: The Case Of The Wind Energy Sector Of Pakistan, Muhammad Amer

Dissertations and Theses

In this modern era, energy is a key element required for sustainable development and prosperity of a society. Pakistan is an energy deficient country facing problems due to the shortage of over 4000 MW of electricity. The national energy sector is heavily dependent on imported fossil-fuel resources. The energy crisis is negatively affecting all economic and business activities, and it is widely recognized as a severe obstacle to growth and poverty reduction in the country. Establishment of wind farms can help to overcome the energy crisis.

In this research, a national level wind energy roadmap is developed through scenario planning. …

Localization Of Rfid Tags Using Stochastic Tunneling, M. R. Basheer, S. Jagannathan

Electrical and Computer Engineering Faculty Research & Creative Works

This paper presents a novel localization scheme in the 3D wireless domain that employs cross correlation in backscattered signal power from a cluster of radio frequency identification (RFID) tags to estimate their location. Spatially co-located RFID tags, energized by a common tag reader, exhibit correlation in their received signal strength indicator (RSSI) values. Hence, for a cluster of RFID tags, the posterior distribution of their unknown radial separation is derived as a function of the measured RSSI correlations between them. The global maxima of this posterior distribution represent the actual radial separation between the RFID tags. The radial separations are …

The Role Of String Similarity Metrics In Ontology Alignment, Michelle Cheatham, Pascal Hitzler

Computer Science and Engineering Faculty Publications

Tim Berners-Lee originally envisioned a much different world wide web than the one we have today - one that computers as well as humans could search for the information they need [3]. There are currently a wide variety of research efforts towards achieving this goal, one of which is ontology alignment.

An Ontology Design Pattern For Cartographic Map Scaling, David Carral, Simon Scheider, Krzysztof Janowicz, Charles Vardeman Ii, Adila A. Krisnadhi, Pascal Hitzler

Computer Science and Engineering Faculty Publications

The concepts of scale is at the core of cartographic abstraction and mapping. It defines which geographic phenomena should be displayed, which type of geometry and map symbol to use, which measures can be taken, as well as the degree to which features need to be exaggerated or spatially displaced. In this work, we present an ontology design pattern for map scaling using the Web Ontology Language (OWL) within a particular extension of the OWL RL profile. We explain how it can be used to describe scaling applications, to reason over scale levels, and geometric representations. We propose an axiomatization …

There's No Money In Linked Data, Prateek Jain, Pascal Hitzler, Krzysztof Janowicz, Chitra Venkatramani

Computer Science and Engineering Faculty Publications

Linked Data (LD) has been an active research area for more than 6 years and many aspects about publishing, retrieving, linking, and cleaning Linked Data have been investigated. There seems to be a broad and general agreement that in principle LD datasets can be very useful for solving a wide variety of problems ranging from practical industrial analytics to highly specific research problems. Having these notions in mind, we started exploring the use of notable LD datasets such as DBpedia, Freebase, Geonames and others for a commercial application. However, it turns out that using these datasets in realistic settings is …