Open Access. Powered by Scholars. Published by Universities.®
- Institution
-
- Embry-Riddle Aeronautical University (392)
- University of New Haven (61)
- Old Dominion University (27)
- Air Force Institute of Technology (22)
- Wayne State University (19)
-
- University of Arkansas, Fayetteville (6)
- Kennesaw State University (3)
- University of Kentucky (3)
- Clemson University (2)
- Edith Cowan University (2)
- Rowan University (2)
- Syracuse University (2)
- Brigham Young University (1)
- California State University, San Bernardino (1)
- Dartmouth College (1)
- Louisiana State University (1)
- Marshall University (1)
- Munster Technological University (1)
- San Jose State University (1)
- Singapore Management University (1)
- University of Louisville (1)
- University of New Mexico (1)
- University of South Alabama (1)
- Keyword
-
- Digital forensics (46)
- Computer forensics (20)
- Forensics (19)
- Digital Forensics (18)
- Cybersecurity (17)
-
- Security (17)
- Digital evidence (15)
- Privacy (13)
- Approximate matching (9)
- Computer Forensics (9)
- Computer security (9)
- Android (8)
- Cyber forensics (8)
- Mobile device forensics (8)
- Mrsh-v2 (8)
- Survey (8)
- Cyber security (7)
- Information security (7)
- Data recovery (6)
- Sdhash (6)
- Cloud computing (5)
- Computer crime (5)
- Cyber crime (5)
- Data disposal (5)
- Disk analysis (5)
- Hashing (5)
- Internet of things (5)
- Mobile forensics (5)
- Model predictive control (5)
- Network forensics (5)
- Publication Year
- Publication
-
- Journal of Digital Forensics, Security and Law (290)
- Annual ADFSL Conference on Digital Forensics, Security and Law (100)
- Electrical & Computer Engineering and Computer Science Faculty Publications (58)
- Theses and Dissertations (21)
- Chemical Engineering and Materials Science Faculty Research Publications (19)
-
- Electrical & Computer Engineering Faculty Publications (15)
- VMASC Publications (6)
- Graduate Theses and Dissertations (4)
- Engineering Technology Faculty Publications (3)
- Master's Theses (3)
- Doctoral Dissertations and Master's Theses (2)
- Electrical Engineering and Computer Science - All Scholarship (2)
- Information Science Faculty Publications (2)
- KSU Proceedings on Cybersecurity Education, Research and Practice (2)
- Research outputs 2022 to 2026 (2)
- AFIT Patents (1)
- All Dissertations (1)
- All Theses (1)
- College of Science & Mathematics Departmental Research (1)
- Computer Science Faculty Publications (1)
- Computer Science and Computer Engineering Undergraduate Honors Theses (1)
- Cybersecurity Undergraduate Research Showcase (1)
- Dartmouth Scholarship (1)
- Electrical Engineering Faculty Publications and Presentations (1)
- Electrical and Computer Engineering ETDs (1)
- Electronic Theses and Dissertations (1)
- Electronic Theses, Projects, and Dissertations (1)
- Engineering Management & Systems Engineering Faculty Publications (1)
- Faculty Publications (1)
- Honors Theses (1)
- Publication Type
Articles 151 - 180 of 552
Full-Text Articles in Information Security
Log Analysis Using Temporal Logic And Reconstruction Approach: Web Server Case, Murat Gunestas, Zeki Bilgin
Log Analysis Using Temporal Logic And Reconstruction Approach: Web Server Case, Murat Gunestas, Zeki Bilgin
Journal of Digital Forensics, Security and Law
We present a post-mortem log analysis method based on Temporal Logic (TL), Event Processing Language (EPL), and reconstruction approach. After showing that the proposed method could be adapted to any misuse event or attack, we specifically investigate the case of web server misuses. To this end, we examine 5 different misuses on Wordpress web servers, and generate corresponding log files of these attacks for forensic analysis. Then we establish attack patterns and formalize them by means of a special case of temporal logic, i.e. many sorted first order metric temporal logic (MSFOMTL). Later on, we implement these attack patterns in …
Low Budget Forensic Drive Imaging Using Arm Based Single Board Computers, Eric Olson, Narasimha Shashidhar
Low Budget Forensic Drive Imaging Using Arm Based Single Board Computers, Eric Olson, Narasimha Shashidhar
Journal of Digital Forensics, Security and Law
Traditional forensic analysis of hard disks and external media typically involves a powered down machine and “dead analysis” of these devices. Forensic acquisition of hard drives and external media has traditionally been by one of several means: standalone forensic duplicator; using a hardware write-blocker or dock attached to a laptop, computer, workstation, etc., forensic operating systems that live boot from a USB, CD/DVD or virtual machines with preinstalled operating systems. Standalone forensics acquisition and imaging devices generally cost thousands of dollars. In this paper, we propose the use of single board computers as forensic imaging devices. Single board computers can …
In-The-Wild Residual Data Research And Privacy, William B. Glisson, Tim Storer, Andrew Blyth, George Grispos, Matt Campbell
In-The-Wild Residual Data Research And Privacy, William B. Glisson, Tim Storer, Andrew Blyth, George Grispos, Matt Campbell
Journal of Digital Forensics, Security and Law
As the world becomes increasingly dependent on technology, researchers in both industry and academia endeavor to understand how technology is used, the impact it has on everyday life, the artifact life-cycle and overall integrations of digital information. In doing so, researchers are increasingly gathering 'real-world' or 'in-the-wild' residual data, obtained from a variety of sources, without the explicit consent of the original owners. This data gathering raises significant concerns regarding privacy, ethics and legislation, as well as practical considerations concerning investigator training, data storage, overall security and data disposal. This research surveys recent studies of residual data gathered in-the-wild and …
Bytewise Approximate Matching: The Good, The Bad, And The Unknown, Vikram S. Harichandran, Frank Breitinger, Ibrahim Baggili
Bytewise Approximate Matching: The Good, The Bad, And The Unknown, Vikram S. Harichandran, Frank Breitinger, Ibrahim Baggili
Journal of Digital Forensics, Security and Law
Hash functions are established and well-known in digital forensics, where they are commonly used for proving integrity and file identification (i.e., hash all files on a seized device and compare the fingerprints against a reference database). However, with respect to the latter operation, an active adversary can easily overcome this approach because traditional hashes are designed to be sensitive to altering an input; output will significantly change if a single bit is flipped. Therefore, researchers developed approximate matching, which is a rather new, less prominent area but was conceived as a more robust counterpart to traditional hashing. Since the conception …
Security Analysis Of Mvhash-B Similarity Hashing, Donghoon Chang, Somitra Sanadhya, Monika Singh
Security Analysis Of Mvhash-B Similarity Hashing, Donghoon Chang, Somitra Sanadhya, Monika Singh
Journal of Digital Forensics, Security and Law
In the era of big data, the volume of digital data is increasing rapidly, causing new challenges for investigators to examine the same in a reasonable amount of time. A major requirement of modern forensic investigation is the ability to perform automatic filtering of correlated data, and thereby reducing and focusing the manual effort of the investigator. Approximate matching is a technique to find “closeness” between two digital artifacts. mvHash-B is a well-known approximate matching scheme used for finding similarity between two digital objects and produces a ‘score of similarity’ on a scale of 0 to 100. However, no security …
An Automated Approach For Digital Forensic Analysis Of Heterogeneous Big Data, Hussam Mohammed, Nathan Clarke, Fudong Li
An Automated Approach For Digital Forensic Analysis Of Heterogeneous Big Data, Hussam Mohammed, Nathan Clarke, Fudong Li
Journal of Digital Forensics, Security and Law
The major challenges with big data examination and analysis are volume, complex interdependence across content, and heterogeneity. The examination and analysis phases are considered essential to a digital forensics process. However, traditional techniques for the forensic investigation use one or more forensic tools to examine and analyse each resource. In addition, when multiple resources are included in one case, there is an inability to cross-correlate findings which often leads to inefficiencies in processing and identifying evidence. Furthermore, most current forensics tools cannot cope with large volumes of data. This paper develops a novel framework for digital forensic analysis of heterogeneous …
On Efficiency Of Distributed Password Recovery, Radek Hranický, Martin Holkovič, Petr Matoušek
On Efficiency Of Distributed Password Recovery, Radek Hranický, Martin Holkovič, Petr Matoušek
Journal of Digital Forensics, Security and Law
One of the major challenges in digital forensics today is data encryption. Due to the leaked information about unlawful sniffing, many users decided to protect their data by encryption. In case of criminal activities, forensic experts are challenged how to decipher suspect's data that are subject to investigation. A common method how to overcome password-based protection is a brute force password recovery using GPU-accelerated hardware. This approach seems to be expensive. This paper presents an alternative approach using task distribution based on BOINC platform. The cost, time and energy efficiency of this approach is discussed and compared to the GPU-based …
Towards Syntactic Approximate Matching - A Pre-Processing Experiment, Doowon Jeong, Frank Breitinger, Hari Kang, Sangjin Lee
Towards Syntactic Approximate Matching - A Pre-Processing Experiment, Doowon Jeong, Frank Breitinger, Hari Kang, Sangjin Lee
Journal of Digital Forensics, Security and Law
Over the past few years the popularity of approximate matching algorithms (a.k.a. fuzzy hashing) has increased. Especially within the area of bytewise approximate matching, several algorithms were published, tested and improved. It has been shown that these algorithms are powerful, however they are sometimes too precise for real world investigations. That is, even very small commonalities (e.g., in the header of a le) can cause a match. While this is a desired property, it may also lead to unwanted results. In this paper we show that by using simple pre-processing, we signicantly can in uence the outcome. Although our test …
Information-Theoretic Secure Outsourced Computation In Distributed Systems, Zhaohong Wang
Information-Theoretic Secure Outsourced Computation In Distributed Systems, Zhaohong Wang
Theses and Dissertations--Electrical and Computer Engineering
Secure multi-party computation (secure MPC) has been established as the de facto paradigm for protecting privacy in distributed computation. One of the earliest secure MPC primitives is the Shamir's secret sharing (SSS) scheme. SSS has many advantages over other popular secure MPC primitives like garbled circuits (GC) -- it provides information-theoretic security guarantee, requires no complex long-integer operations, and often leads to more efficient protocols. Nonetheless, SSS receives less attention in the signal processing community because SSS requires a larger number of honest participants, making it prone to collusion attacks. In this dissertation, I propose an agent-based computing framework using …
Digital Forensics In Law Enforcement: A Needs Based Analysis Of Indiana Agencies, Teri A. Cummins Flory
Digital Forensics In Law Enforcement: A Needs Based Analysis Of Indiana Agencies, Teri A. Cummins Flory
Journal of Digital Forensics, Security and Law
Cyber crime is a growing problem, with the impact to society increasing exponentially, but the ability of local law enforcement agencies to investigate and successfully prosecute criminals for these crimes is unclear. Many national needs assessments have previously been conducted, and all indicated that state and local law enforcement did not have the training, tools, or staff to effectively conduct digital investigations, but very few have been completed recently. This study provided a current and localized assessment of the ability of Indiana law enforcement agencies to effectively investigate crimes involving digital evidence, the availability of training for both law enforcement …
Verification Of Recovered Digital Evidence On The Amazon Kindle, Marcus Thompson, Raymond Hansen
Verification Of Recovered Digital Evidence On The Amazon Kindle, Marcus Thompson, Raymond Hansen
Journal of Digital Forensics, Security and Law
The Amazon Kindle is a popular e-book reader. This popularity will lead criminals to use the Kindle as an accessory to their crime. Very few Kindle publications in the digital forensics domain exist at the time of this writing. Various blogs on the Internet currently provide some of the foundation for Kindle forensics. For this research each fifth generation Kindle was populated with various types of files a typical user may introduce using one method, the USB interface. The Kindle was forensically imaged with AccessData’s Forensic Toolkit Imager before and after each Kindle was populated. Each file was deleted through …
Making Sense Of Email Addresses On Drives, Neil C. Rowe, Riqui Schwamm, Michael R. Mccarrin, Ralucca Gera
Making Sense Of Email Addresses On Drives, Neil C. Rowe, Riqui Schwamm, Michael R. Mccarrin, Ralucca Gera
Journal of Digital Forensics, Security and Law
Drives found during investigations often have useful information in the form of email addresses which can be acquired by search in the raw drive data independent of the file system. Using this data we can build a picture of the social networks that a drive owner participated in, even perhaps better than investigating their online profiles maintained by social-networking services because drives contain much data that users have not approved for public display. However, many addresses found on drives are not forensically interesting, such as sales and support links. We developed a program to filter these out using a Naïve …
Countering Noise-Based Splicing Detection Using Noise Density Transfer, Thibault Julliand, Vincent Nozick, Hugues Talbot
Countering Noise-Based Splicing Detection Using Noise Density Transfer, Thibault Julliand, Vincent Nozick, Hugues Talbot
Journal of Digital Forensics, Security and Law
Image splicing is a common and widespread type of manipulation, which is defined as pasting a portion of an image onto a second image. Several forensic methods have been developed to detect splicing, using various image properties. Some of these methods exploit the noise statistics of the image to try and find discrepancies. In this paper, we propose a new counter-forensic approach to eliminate the noise differences that can appear in a spliced image. This approach can also be used when creating computer graphics images, in order to endow them with a realistic noise. This is performed by changing the …
Evidential Reasoning For Forensic Readiness, Yi-Ching Liao, Hanno Langweg
Evidential Reasoning For Forensic Readiness, Yi-Ching Liao, Hanno Langweg
Journal of Digital Forensics, Security and Law
To learn from the past, we analyse 1,088 "computer as a target" judgements for evidential reasoning by extracting four case elements: decision, intent, fact, and evidence. Analysing the decision element is essential for studying the scale of sentence severity for cross-jurisdictional comparisons. Examining the intent element can facilitate future risk assessment. Analysing the fact element can enhance an organization's capability of analysing criminal activities for future offender profiling. Examining the evidence used against a defendant from previous judgements can facilitate the preparation of evidence for upcoming legal disclosure. Follow the concepts of argumentation diagrams, we develop an automatic judgement summarizing …
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
Electronic Voting Service Using Block-Chain, Kibin Lee, Joshua I. James, Tekachew G. Ejeta, Hyoung J. Kim
Electronic Voting Service Using Block-Chain, Kibin Lee, Joshua I. James, Tekachew G. Ejeta, Hyoung J. Kim
Journal of Digital Forensics, Security and Law
Cryptocurrency, and its underlying technologies, has been gaining popularity for transaction management beyond financial transactions. Transaction information is maintained in the block-chain, which can be used to audit the integrity of the transaction. The focus on this paper is the potential availability of block-chain technology of other transactional uses. Block-chain is one of the most stable open ledgers that preserves transaction information, and is difficult to forge. Since the information stored in block-chain is not related to personally identify information, it has the characteristics of anonymity. Also, the block-chain allows for transparent transaction verification since all information in the block-chain …
Exploring Deviant Hacker Networks (Dhn) On Social Media Platforms, Samer Al-Kateeb, Kevin Conlan, Nitin Agarwal, Ibrahim Baggili, Frank Breitinger
Exploring Deviant Hacker Networks (Dhn) On Social Media Platforms, Samer Al-Kateeb, Kevin Conlan, Nitin Agarwal, Ibrahim Baggili, Frank Breitinger
Electrical & Computer Engineering and Computer Science Faculty Publications
Online Social Networks (OSNs) have grown exponentially over the past decade. The initial use of social media for benign purposes (e.g., to socialize with friends, browse pictures and photographs, and communicate with family members overseas) has now transitioned to include malicious activities (e.g., cybercrime, cyberterrorism, and cyberwarfare). These nefarious uses of OSNs poses a signi_cant threat to society, and thus requires research attention. In this exploratory work, we study activities of one deviant groups: hacker groups on social media, which we term Deviant Hacker Networks (DHN). We investigated the connection between different DHNs on Twitter: how they are connected, identified …
Towards Syntactic Approximate Matching-A Pre-Processing Experiment, Doowon Jeong, Frank Breitinger, Hari Kang, Sangjin Lee
Towards Syntactic Approximate Matching-A Pre-Processing Experiment, Doowon Jeong, Frank Breitinger, Hari Kang, Sangjin Lee
Electrical & Computer Engineering and Computer Science Faculty Publications
Over the past few years, the popularity of approximate matching algorithms (a.k.a. fuzzy hashing) has increased. Especially within the area of bytewise approximate matching, several algorithms were published, tested, and improved. It has been shown that these algorithms are powerful, however they are sometimes too precise for real world investigations. That is, even very small commonalities (e.g., in the header of a file) can cause a match. While this is a desired property, it may also lead to unwanted results. In this paper, we show that by using simple pre-processing, we significantly can influence the outcome. Although our test set …
Find Me If You Can: Mobile Gps Mapping Applications Forensic Analysis & Snavp The Open Source, Modular, Extensible Parser, Jason Moore, Ibrahim Baggili, Frank Breitinger
Find Me If You Can: Mobile Gps Mapping Applications Forensic Analysis & Snavp The Open Source, Modular, Extensible Parser, Jason Moore, Ibrahim Baggili, Frank Breitinger
Electrical & Computer Engineering and Computer Science Faculty Publications
The use of smartphones as navigation devices has become more prevalent. The ubiquity of hand-held navigation devices such as Garmins or Toms Toms has been falling whereas the ownership of smartphones and their adoption as GPS devices is growing. This work provides a comprehensive study of the most popular smartphone mapping applications, namely Google Maps, Apple Maps, Waze, MapQuest, Bing, and Scout, on both Android and iOS. It details what data was found, where it was found, and how it was acquired for each application. Based on the findings, the work allowed for the construction of a tool capable of …
Whatsapp Network Forensics: Decrypting And Understanding The Whatsapp Call Signaling Messages, Filip Karpisek, Ibrahim Baggili, Frank Breitinger
Whatsapp Network Forensics: Decrypting And Understanding The Whatsapp Call Signaling Messages, Filip Karpisek, Ibrahim Baggili, Frank Breitinger
Electrical & Computer Engineering and Computer Science Faculty Publications
WhatsApp is a widely adopted mobile messaging application with over 800 million users. Recently, a calling feature was added to the application and no comprehensive digital forensic analysis has been performed with regards to this feature at the time of writing this paper. In this work, we describe how we were able to decrypt the network traffic and obtain forensic artifacts that relate to this new calling feature which included the: a) WhatsApp phone numbers, b) WhatsApp server IPs, c) WhatsApp audio codec (Opus), d) WhatsApp call duration, and e) WhatsApp's call termination. We explain the methods and tools used …
Professor Frank Breitinger's Full Bibliography, Frank Breitinger
Professor Frank Breitinger's Full Bibliography, Frank Breitinger
Electrical & Computer Engineering and Computer Science Faculty Publications
No abstract provided.
Pinpoint: Efficient And Effective Resource Isolation For Mobile Security And Privacy, Paul Ratazzi, Ashok Bommisetti, Nian Ji, Wenliang Du
Pinpoint: Efficient And Effective Resource Isolation For Mobile Security And Privacy, Paul Ratazzi, Ashok Bommisetti, Nian Ji, Wenliang Du
Electrical Engineering and Computer Science - All Scholarship
Virtualization is frequently used to isolate untrusted processes and control their access to sensitive resources. However, isolation usually carries a price in terms of less resource sharing and reduced inter-process communication. In an open architecture such as Android, this price and its impact on performance, usability, and transparency must be carefully considered. Although previous efforts in developing general-purpose isolation solutions have shown that some of these negative sideeffects can be mitigated, doing so involves overcoming significant design challenges by incorporating numerous additional platform complexities not directly related to improved security. Thus, the general purpose solutions become inefficient and burdensome if …
Con-Resistant Trust For Improved Reliability In A Smart Grid Special Protection System, Crystal M. Shipman, Kenneth M. Hopkinson, Juan L. Lopez Jr.
Con-Resistant Trust For Improved Reliability In A Smart Grid Special Protection System, Crystal M. Shipman, Kenneth M. Hopkinson, Juan L. Lopez Jr.
Faculty Publications
This paper applies a con-resistant trust mechanism to improve the performance of a communications-based special protection system to enhance its effectiveness and resiliency. Smart grids incorporate modern information technologies to increase reliability and efficiency through better situational awareness. However, with the benefits of this new technology come the added risks associated with threats and vulnerabilities to the technology and to the critical infrastructure it supports. The research in this paper uses con-resistant trust to quickly identify malicious or malfunctioning (untrustworthy) protection system nodes to mitigate instabilities. The con-resistant trust mechanism allows protection system nodes to make trust assessments based on …
Table Of Contents
Journal of Digital Forensics, Security and Law
No abstract provided.
From The Editor-In-Chief, Ibrahim Baggili
From The Editor-In-Chief, Ibrahim Baggili
Journal of Digital Forensics, Security and Law
Welcome to JDFSL’s second issue for 2015! First, I would like to thank our editorial board, reviewers, and the JDFSL team for bringing this issue to life. In this issue, we continue our multidisciplinary tradition. The first paper, Two challenges of stealthy hypervisors detection: time cheating and data fluctuations, showcases an important contribution to the computing discipline. The use of virtualization has dramatically increased given our strong reliance on cloud services both private and public. Even though hypervisors enhance security, they can also be exploited by malware. Therefore, this paper is of importance given that it introduces a novel method …
From The Editor-In-Chief, Ibrahim Baggili
From The Editor-In-Chief, Ibrahim Baggili
Journal of Digital Forensics, Security and Law
Welcome to JDFSL’s first issue for 2015! First, I would like to thank our editorial board, reviewers, and the JDFSL team for bringing this issue to life. It has been a big year for JDFSL as the journal continues to progress. We are continuing our indexing efforts for the journal and we are getting closer with some of the major databases.
Network And Device Forensic Analysis Of Android Social-Messaging Applications, Daniel Walnycky, Ibrahim Baggili, Andrew Marrington, Jason Moore, Frank Breitinger
Network And Device Forensic Analysis Of Android Social-Messaging Applications, Daniel Walnycky, Ibrahim Baggili, Andrew Marrington, Jason Moore, Frank Breitinger
Electrical & Computer Engineering and Computer Science Faculty Publications
In this research we forensically acquire and analyze the device-stored data and network traffic of 20 popular instant messaging applications for Android. We were able to reconstruct some or the entire message content from 16 of the 20 applications tested, which reflects poorly on the security and privacy measures employed by these applications but may be construed positively for evidence collection purposes by digital forensic practitioners. This work shows which features of these instant messaging applications leave evidentiary traces allowing for suspect data to be reconstructed or partially reconstructed, and whether network forensics or device forensics permits the reconstruction of …
An Empirical Comparison Of Widely Adopted Hash Functions In Digital Forensics: Does The Programming Language And Operating System Make A Difference?, Satyendra Gurjar, Ibrahim Baggili, Frank Breitinger, Alice E. Fischer
An Empirical Comparison Of Widely Adopted Hash Functions In Digital Forensics: Does The Programming Language And Operating System Make A Difference?, Satyendra Gurjar, Ibrahim Baggili, Frank Breitinger, Alice E. Fischer
Electrical & Computer Engineering and Computer Science Faculty Publications
Hash functions are widespread in computer sciences and have a wide range of applications such as ensuring integrity in cryptographic protocols, structuring database entries (hash tables) or identifying known files in forensic investigations. Besides their cryptographic requirements, a fundamental property of hash functions is efficient and easy computation which is especially important in digital forensics due to the large amount of data that needs to be processed when working on cases. In this paper, we correlate the runtime efficiency of common hashing algorithms (MD5, SHA-family) and their implementation. Our empirical comparison focuses on C-OpenSSL, Python, Ruby, Java on Windows and …
Litigation Holds: Past, Present, And Future Directions, Milton Luoma, Vicki M. Luoma
Litigation Holds: Past, Present, And Future Directions, Milton Luoma, Vicki M. Luoma
Journal of Digital Forensics, Security and Law
Electronically Stored Information (ESI) first became a serious litigation issue in the late 1990s, and the first attempts to determine best practices did not occur until the early 2000s. As best practices developed, the litigation hold to prevent routine destruction of documents and to preserve documents relevant to litigation came into existence. The duty to preserve ESI is triggered when litigation is reasonably anticipated. All information that relates to potential litigation must be preserved from the time it becomes reasonably apparent that litigation is possible until the expiration of the statute of limitations. If steps are not taken to properly …