Computer Sciences Commons^™

A Survey Of Mobile Computing Security Issues And Possible Solutions, Glenn Kimpell

All Capstone Projects

This project reviews security issues with mobile devices and offers possible solutions from Internet sources. (supplied by OPUS staff)

A Pollution Attack To Public-Key Watermarking Schemes, Yongdong Wu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Public-key watermarking schemes are required to possess two desirable properties: allowing everyone to determine whether a watermark exists in an image or not and ensuring high detection probability in case of malicious modification. In this paper we propose an attack which pollutes the watermark embedded in an image with an optimal colored noise so as to fool the detector of the underlying public-key watermarking scheme. We further show how to apply the proposed pollution attack to public-key subspace watermarking schemes to generate pirated images of high quality but of low detection probability. Our experiment results demonstrate that the proposed pollution …

Identifying And Attributing Similar Traces With Greatest Common Factor Analysis, Fred Cohen

Journal of Digital Forensics, Security and Law

This paper presents an algorithm for comparing large numbers of traces to each other and identifying and presenting groups of traces with similar features. It is applied to forensic analysis in which groups of similar traces are automatically identified and presented so that attribution and other related claims may be asserted, and independently confirmed or refuted. The approach of this paper is to identify an approximate algorithm that will find a large subset of greatest common factor similar groups of arbitrary factors in far less time and space than an exact algorithm using examiner-provided selection criteria for factor definition.

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Process Flow Features As A Host-Based Event Knowledge Representation, Benhur E. Pacer

Theses and Dissertations

The detection of malware is of great importance but even non-malicious software can be used for malicious purposes. Monitoring processes and their associated information can characterize normal behavior and help identify malicious processes or malicious use of normal process by measuring deviations from the learned baseline. This exploratory research describes a novel host feature generation process that calculates statistics of an executing process during a window of time called a process flow. Process flows are calculated from key process data structures extracted from computer memory using virtual machine introspection. Each flow cluster generated using k-means of the flow features represents …

Mining Input Sanitization Patterns For Predicting Sql Injection And Cross Site Scripting Vulnerabilities, Lwin Khin Shar, Hee Beng Kuan Tan

Research Collection School Of Computing and Information Systems

Static code attributes such as lines of code and cyclomatic complexity have been shown to be useful indicators of defects in software modules. As web applications adopt input sanitization routines to prevent web security risks, static code attributes that represent the characteristics of these routines may be useful for predicting web application vulnerabilities. In this paper, we classify various input sanitization methods into different types and propose a set of static code attributes that represent these types. Then we use data mining methods to predict SQL injection and cross site scripting vulnerabilities in web applications. Preliminary experiments show that our …

Where Should The Bugs Be Fixed? More Accurate Information Retrieval-Based Bug Localization Based On Bug Reports, Jian Zhou, Hongyu Zhang, David Lo

Research Collection School Of Computing and Information Systems

For a large and evolving software system, the project team could receive a large number of bug reports. Locating the source code files that need to be changed in order to fix the bugs is a challenging task. Once a bug report is received, it is desirable to automatically point out to the files that developers should change in order to fix the bug. In this paper, we propose BugLocator, an information retrieval based method for locating the relevant files for fixing a bug. BugLocator ranks all files based on the textual similarity between the initial bug report and the …

A New Framework For Privacy Of Rfid Path Authentication, Shaoying Cai, Robert H. Deng, Yingjiu Li, Yunlei Zhao

Research Collection School Of Computing and Information Systems

RFID-based path authentication enables supply chain managers to verify the exact path that a tag has taken. In this paper, we introduce a new oracle Move that models a tag's movement along a designed or an arbitrary path in a supply chain. With this oracle, we refine the existing security and privacy notions for RFID-based path authentication. In addition, we propose a new privacy notion, called path privacy, for RFID-based path authentication. Our privacy notion captures the privacy of both tag identity and path information in a single game. Compared to existing two-game based privacy notions, it is more rigorous, …

Active Malware Analysis Using Stochastic Games, Simon Williamson, Pradeep Reddy Varakantham, Debin Gao, Chen Hui Ong

Research Collection School Of Computing and Information Systems

Cyber security is increasingly important for defending computer systems from loss of privacy or unauthorised use. One important aspect is threat analysis - how does an attacker infiltrate a system and what do they want once they are inside. This paper considers the problem of Active Malware Analysis, where we learn about the human or software intruder by actively interacting with it with the goal of learning about its behaviours and intentions, whilst at the same time that intruder may be trying to avoid detection or showing those behaviours and intentions. This game-theoretic active learning is then used to obtain …

Trurepec: A Trust-Behavior-Based Reputation And Recommender System For Mobile Applications, Zheng Yan, Peng Zhang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Mobile applications are software packages that can be installed and executed in a mobile device. Which mobile application is trustworthy for a user to purchase, download, install, execute or recommend becomes a crucial issue that impacts its final success. This paper proposes TruBeRepec, a trust-behavior-based reputation and recommender system for mobile applications. We explore a model of trust behavior for mobile applications based on the result of a large-scale user survey. We further develop a number of algorithms that are used to evaluate individual user’s trust in a mobile application through trust behavior observation, generate the application’s reputation by aggregating …

Distributed Path Authentication For Dynamic Rfid-Enabled Supply Chains, Shaoying Cai, Yingjiu Li, Yunlei Zhao

Research Collection School Of Computing and Information Systems

In this paper, we propose a distributed path authentication solution for dynamic RFID-enabled supply chains to address the counterfeiting problem. Compared to existing general anti-counterfeiting solutions, our solution requires non sharing of item-level RFID information among supply chain parties, thus eliminating the requirement on high network bandwidth and fine-grained access control. Our solution is secure, privacy-preserving, and practical. It leverages on the standard EPCglobal network to share information about paths and parties in path authentication. Our solution can be implemented on standard EPC class 1 generation 2 tags with only 720 bits storage and no computational capability.

Digital Evidence Education In Schools Of Law, Aaron Alva, Barbara Endicott-Popovsky

Annual ADFSL Conference on Digital Forensics, Security and Law

An examination of State of Connecticut v. Julie Amero provides insight into how a general lack of understanding of digital evidence can cause an innocent defendant to be wrongfully convicted. By contrast, the 101-page opinion in Lorraine v. Markel American Insurance Co. provides legal precedence and a detailed consideration for the admission of digital evidence. An analysis of both cases leads the authors to recommend additions to Law School curricula designed to raise the awareness of the legal community to ensure such travesties of justice, as in the Amero case, don’t occur in the future. Work underway at the University …

A Case Study Of The Challenges Of Cyber Forensics Analysis Of Digital Evidence In A Child Pornography Trial, Richard Boddington

Annual ADFSL Conference on Digital Forensics, Security and Law

Perfunctory case analysis, lack of evidence validation, and an inability or unwillingness to present understandable analysis reports adversely affect the outcome course of legal trials reliant on digital evidence. These issues have serious consequences for defendants facing heavy penalties or imprisonment yet expect their defence counsel to have clear understanding of the evidence. Poorly reasoned, validated and presented digital evidence can result in conviction of the innocent as well as acquittal of the guilty. A possession of child pornography Case Study highlights the issues that appear to plague case analysis and presentation of digital evidence relied on in these odious …

After Five Years Of E-Discovery Missteps: Sanctions Or Safe Harbor?, Milton Luoma, Vicki Luoma

Annual ADFSL Conference on Digital Forensics, Security and Law

In 2003 the Zubulake case became the catalyst of change in the world of e-discovery. In that case Judge Shira Scheindlin of the United States District Court for the Southern District of New York set guidelines for e-discovery that served as the basis for amending the Federal Rules of Civil Procedure (FRCP) in December 2006. The amendments incorporated a number of concepts that were described by Judge Scheindlin in the Zubulake case. ( Zubulake v. UBS Warburg LLC, 2003) Since the Zubulake case and the FRCP amendments, numerous cases have interpreted these rules changes, but one of the main points …

Multi-Parameter Sensitivity Analysis Of A Bayesian Network From A Digital Forensic Investigation, Richard E. Overill, Echo P. Zhang, Kam-Pui Chow

Annual ADFSL Conference on Digital Forensics, Security and Law

A multi-parameter sensitivity analysis of a Bayesian network (BN) used in the digital forensic investigation of the Yahoo! email case has been performed using the principle of ‘steepest gradient’ in the parameter space of the conditional probabilities. This procedure delivers a more reliable result for the dependence of the posterior probability of the BN on the values used to populate the conditional probability tables (CPTs) of the BN. As such, this work extends our previous studies using singleparameter sensitivity analyses of BNs, with the overall aim of more deeply understanding the indicative use of BNs within the digital forensic and …

Facilitating Forensics In The Mobile Millennium Through Proactive Enterprise Security, Andrew R. Scholnick

Annual ADFSL Conference on Digital Forensics, Security and Law

This work explores the impact of the emerging mobile communication device paradigm on the security-conscious enterprise, with regard to providing insights for proactive Information Assurance and facilitation of eventual Forensic analysis. Attention is given to technology evolution in the areas of best practices, attack vectors, software and hardware performance, access and activity monitoring, and architectural models.

Keywords: Forensics, enterprise security, mobile communication, best practices, attack vectors.

Cloud Forensics Investigation: Tracing Infringing Sharing Of Copyrighted Content In Cloud, Yi-Jun He, Echo P. Zhang, Lucas C.K. Hui, Siu Ming Yiu, K.P. Chow

Annual ADFSL Conference on Digital Forensics, Security and Law

Cloud Computing is becoming a significant technology trend nowadays, but its abrupt rise also creates a brand new front for cybercrime investigation with various challenges. One of the challenges is to track down infringing sharing of copyrighted content in cloud. To solve this problem, we study a typical type of content sharing technologies in cloud computing, analyze the challenges that the new technologies bring to forensics, formalize a procedure to get digital evidences and obtain analytical results based on the evidences to track down illegal uploader. Furthermore, we propose a reasoning model based on the probability distribution in a Bayesian …

Ipad2 Logical Acquisition: Automated Or Manual Examination?, Somaya Ali, Sumaya Alhosani, Farah Alzarooni, Ibrahim Baggili

Annual ADFSL Conference on Digital Forensics, Security and Law

Due to their usage increase worldwide, iPads are on the path of becoming key sources of digital evidence in criminal investigations. This research investigated the logical backup acquisition and examination of the iPad2 device using the Apple iTunes backup utility while manually examining the backup data (manual examination) and automatically parsing the backup data (Lantern software - automated examination). The results indicate that a manual examination of the logical backup structure from iTunes reveals more digital evidence, especially if installed application data is required for an investigation. However, the researchers note that if a quick triage is needed of an …

A Fuzzy Hashing Approach Based On Random Sequences And Hamming Distance, Frank Breitinger, Harald Baier

Annual ADFSL Conference on Digital Forensics, Security and Law

Hash functions are well-known methods in computer science to map arbitrary large input to bit strings of a fixed length that serve as unique input identifier/fingerprints. A key property of cryptographic hash functions is that even if only one bit of the input is changed the output behaves pseudo randomly and therefore similar files cannot be identified. However, in the area of computer forensics it is also necessary to find similar files (e.g. different versions of a file), wherefore we need a similarity preserving hash function also called fuzzy hash function. In this paper we present a new approach for …

The Xbox 360 And Steganography: How Criminals And Terrorists Could Be "Going Dark", Ashley Podhradsky, Rob D’Ovidio, Cindy Casey

Annual ADFSL Conference on Digital Forensics, Security and Law

Video game consoles have evolved from single-player embedded systems with rudimentary processing and graphics capabilities to multipurpose devices that provide users with parallel functionality to contemporary desktop and laptop computers. Besides offering video games with rich graphics and multiuser network play, today's gaming consoles give users the ability to communicate via email, video and text chat; transfer pictures, videos, and file;, and surf the World-Wide-Web. These communication capabilities have, unfortunately, been exploited by people to plan and commit a variety of criminal activities. In an attempt to cover the digital tracks of these unlawful undertakings, anti-forensic techniques, such as steganography, …

Double-Compressed Jpeg Detection In A Steganalysis System, Jennifer L. Davidson, Pooja Parajape

Annual ADFSL Conference on Digital Forensics, Security and Law

The detection of hidden messages in JPEG images is a growing concern. Current detection of JPEG stego images must include detection of double compression: a JPEG image is double compressed if it has been compressed with one quality factor, uncompressed, and then re-compressed with a different quality factor. When detection of double compression is not included, erroneous detection rates are very high. The main contribution of this paper is to present an efficient double-compression detection algorithm that has relatively lower dimensionality of features and relatively lower computational time for the detection part, than current comparative classifiers. We use a model-based …

Toward Alignment Between Communities Of Practice And Knowledge-Based Decision Support, Jason Nichols, David Biros, Mark Weiser

Annual ADFSL Conference on Digital Forensics, Security and Law

The National Repository of Digital Forensics Information (NRDFI) is a knowledge repository for law enforcement digital forensics investigators (LEDFI). Over six years, the NRDFI has undertaken significant design revisions in order to more closely align the architecture of the system with theory addressing motivation to share knowledge and communication within ego-centric groups and communities of practice. These revisions have been met with minimal change in usage patterns by LEDFI community members, calling into question the applicability of relevant theory when the domain for knowledge sharing activities expands beyond the confines of an individual organization to a community of practice. When …

A Proposal For Incorporating Programming Blunder As Important Evidence In Abstraction-Filtration-Comparison Test, P. Vinod Bhattathiripad

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper investigates an unexplored concept in Cyber Forensics, namely, a Programming Blunder. Programming Blunder is identified as a variable or a code segment or a field in a database table, which is hardly used or executed in the context of the application or the user’s functionality. Blunder genes can be found in many parts of any program. It is the contention of this paper that this phenomenon of blunders needs to be studied systematically from its very genetic origins to their surface realizations in contrast to bugs and flaws, especially in view of their importance in software copyright infringement …

Update On The State Of The Science Of Digital Evidence Examination, Fred Cohen

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper updates previous work on the level of consensus in foundational elements of digital evidence examination. Significant consensus is found present only after definitions are made explicit, suggesting that, while there is a scientific agreement around some of the basic notions identified, the use of a common language is lacking.

Keywords: Digital forensics examination, terminology, scientific methodology, testability, validation, classification, scientific consensus

Recognizing Patterns In Transmitted Signals For Identification Purposes, Baha' A. Alsaify

Graduate Theses and Dissertations

The ability to identify and authenticate entities in cyberspace such as users, computers, cell phones, smart cards, and radio frequency identification (RFID) tags is usually accomplished by having the entity demonstrate knowledge of a secret key. When the entity is portable and physically accessible, like an RFID tag, it can be difficult to secure given the memory, processing, and economic constraints. This work proposes to use unique patterns in the transmitted signals caused by manufacturing differences to identify and authenticate a wireless device such as an RFID tag. Both manufacturer identification and tag identification are performed on a population of …

Mitigating Insider Threat In Relational Database Systems, Qussai Yaseen

Graduate Theses and Dissertations

The dissertation concentrates on addressing the factors and capabilities that enable insiders to violate systems security. It focuses on modeling the accumulative knowledge that insiders get throughout legal accesses, and it concentrates on analyzing the dependencies and constraints among data items and represents them using graph-based methods. The dissertation proposes new types of Knowledge Graphs (KGs) to represent insiders' knowledgebases. Furthermore, it introduces the Neural Dependency and Inference Graph (NDIG) and Constraints and Dependencies Graph (CDG) to demonstrate the dependencies and constraints among data items. The dissertation discusses in detail how insiders use knowledgebases and dependencies and constraints to get …

Expressive Cp-Abe With Partially Hidden Access Structures, Junzuo Lai, Robert H. Deng, Yingjiu Li

Research Collection School Of Computing and Information Systems

At Eurocrypt 2005, Sahai and Waters [7] introduced the concept of attribute-based encryption (ABE). ABE enables public key based one-to-many encryption and is envisioned as a promising cryptographic primitive for realizing scalable and fine-grained access control systems. There are two kinds of ABE schemes [1], key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE) schemes. This paper, our concern is on the latter.

Coercion Resistance In Authentication Responsibility Shifting, Payas Gupta, Xuhua Ding, Debin Gao

Research Collection School Of Computing and Information Systems

Responsibility shifting, a popular solution used in the event of failure of primary authentication where a human helper is involved in regaining access, is vulnerable to coercion attacks. In this work, we report our user study which investigates the helper’s emotional status when being coerced to assist in an attack. Results show that the coercion causes involuntary skin conductance fluctuation on the helper, which indicates that he/she is nervous and stressed. This response can be used to strengthen the security of the authentication system by providing coercion resistance.