Other Computer Sciences Commons^™

On The Network Performance Of Digital Evidence Acquisition Of Small Scale Devices Over Public Networks, Irvin Homem, Spyridon Dosis

Annual ADFSL Conference on Digital Forensics, Security and Law

While cybercrime proliferates – becoming more complex and surreptitious on the Internet – the tools and techniques used in performing digital investigations are still largely lagging behind, effectively slowing down law enforcement agencies at large. Real-time remote acquisition of digital evidence over the Internet is still an elusive ideal in the combat against cybercrime. In this paper we briefly describe the architecture of a comprehensive proactive digital investigation system that is termed as the Live Evidence Information Aggregator (LEIA). This system aims at collecting digital evidence from potentially any device in real time over the Internet. Particular focus is made …

A Review Of Recent Case Law Related To Digital Forensics: The Current Issues, Kelly A. Cole, Shruti Gupta, Dheeraj Gurugubelli, Marcus K. Rogers

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital forensics is a new field without established models of investigation. This study uses thematic analysis to explore the different issues seen in the prosecution of digital forensic investigations. The study looks at 100 cases from different federal appellate courts to analyze the cause of the appeal. The issues are categorized into one of four categories, ‘search and seizure’, ‘data analysis’, ‘presentation’ and ‘legal issues’. The majority of the cases reviewed related to the search and seizure activity.

Keywords: Computer Investigation, Case Law, Digital Forensics, Legal Issues, and Courts

A New Cyber Forensic Philosophy For Digital Watermarks In The Context Of Copyright Laws, Vinod P. Bhattathiripad, Sneha Sudhakaran, Roshna K. Thalayaniyil

Annual ADFSL Conference on Digital Forensics, Security and Law

The objective of this paper is to propose a new cyber forensic philosophy for watermark in the context of copyright laws for the benefit of the forensic community and the judiciary worldwide. The paper first briefly introduces various types of watermarks, and then situates watermarks in the context of the ideaexpression dichotomy and the copyright laws. It then explains the forensic importance of watermarks and proposes a forensic philosophy for them in the context of copyright laws. Finally, the paper stresses the vital need to incorporate watermarks in the forensic tests to establish software copyright infringement and also urges the …

A Survey Of Software-Based String Matching Algorithms For Forensic Analysis, Yi-Ching Liao

Annual ADFSL Conference on Digital Forensics, Security and Law

Employing a fast string matching algorithm is essential for minimizing the overhead of extracting structured files from a raw disk image. In this paper, we summarize the concept, implementation, and main features of ten software-based string matching algorithms, and evaluate their applicability for forensic analysis. We provide comparisons between the selected software-based string matching algorithms from the perspective of forensic analysis by conducting their performance evaluation for file carving. According to the experimental results, the Shift-Or algorithm (R. Baeza-Yates & Gonnet, 1992) and the Karp-Rabin algorithm (Karp & Rabin, 1987) have the minimized search time for identifying the locations of …

Investigating Forensics Values Of Windows Jump Lists Data, Ahmad Ghafarian

Annual ADFSL Conference on Digital Forensics, Security and Law

Starting with Windows 7, Microsoft introduced a new feature to the Windows Operating Systems called Jump Lists. Jump Lists stores information about user activities on the host machine. These activities may include links to the recently visited web pages, applications executed, or files processed. Computer forensics investigators may find traces of misuse in Jump Lists auto saved files. In this research, we investigate the forensics values of Jump Lists data. Specifically, we use several tools to view Jump Lists data on a virtual machine. We show that each tool reveal certain types of information about user’s activity on the host …

An Empirical Comparison Of Widely Adopted Hash Functions In Digital Forensics: Does The Programming Language And Operating System Make A Difference?, Satyendra Gurjar, Ibrahim Baggili, Frank Breitinger, Alice Fischer

Annual ADFSL Conference on Digital Forensics, Security and Law

Hash functions are widespread in computer sciences and have a wide range of applications such as ensuring integrity in cryptographic protocols, structuring database entries (hash tables) or identifying known files in forensic investigations. Besides their cryptographic requirements, a fundamental property of hash functions is efficient and easy computation which is especially important in digital forensics due to the large amount of data that needs to be processed when working on cases. In this paper, we correlate the runtime efficiency of common hashing algorithms (MD5, SHA-family) and their implementation. Our empirical comparison focuses on C-OpenSSL, Python, Ruby, Java on Windows and …

Two Challenges Of Stealthy Hypervisors Detection: Time Cheating And Data Fluctuations, Igor Korkin

Annual ADFSL Conference on Digital Forensics, Security and Law

Hardware virtualization technologies play a significant role in cyber security. On the one hand these technologies enhance security levels, by designing a trusted operating system. On the other hand these technologies can be taken up into modern malware which is rather hard to detect. None of the existing methods is able to efficiently detect a hypervisor in the face of countermeasures such as time cheating, temporary self-uninstalling, memory hiding etc. New hypervisor detection methods which will be described in this paper can detect a hypervisor under these countermeasures and even count several nested ones. These novel approaches rely on the …

Using A Nearest Neighbor Algorithm And Logistic Regression To Assess Hazard Identification In The U.S. Army Risk Management Process, Heath L. Mccormick

Theses and Dissertations

This research considers whether a person's demographic and experiential attributes play a significant role in how they perceive the presence or absence of hazards in a given situation. The goal of the research is to show that participants with enlisted military experience, prior to being commissioned as a junior officer, would be more successful at identifying the hazards presented in military scenarios than those who had only been trained on the process via their pre-commissioning and initial entry courses of instruction. The research study involves the use of two surveys with realistic military scenarios including both Foot March and Maintenance …

Robust And Real-Time Stereo Matching On Parallel Graphics Hardware Using Gradient-Based Disparity Refinement, Jedrzej Kowalczuk

Department of Electrical and Computer Engineering: Dissertations, Theses, and Student Research

Computer vision attempts to provide camera-equipped machines with visual perception, i.e., the capability to comprehend their surroundings through the analysis and understanding of images. The ability to perceive depth is a vital component of visual perception that enables machines to interpret the three-dimensional structure of their surroundings and allows them to navigate through the environment. In computer vision, depth perception is achieved via stereo matching, a process that identifies correspondences between pixels in images acquired using a pair of horizontally offset cameras. It is possible to calculate depths from correspondences or, more specifically, the positional offsets (disparities) between pixels in …

Simple Secrecy: Analog Stream Cipher For Secure Voice Communication, John M. Campbell

Senior Honors Theses

Voice signals are inherently analog, and some voice communication systems still utilize analog signals. Existing analog cryptographic methods do not satisfactorily provide cryptosecurity for communication systems due to several limitations. This paper proposes a novel means of provided cryptosecurity for analog signals without digitization; thereby avoiding the latency which results from ADC/DAC conversions. This method utilizes the principles of the digital stream cipher, generating instead a continuous pseudorandom analog key stream signal which is transformed with the original analog signal to create an encrypted ciphertext signal which is statistically independent of the original signal and the key stream signal. The …

Clustering Header Categories Extracted From Web Tables, George Nagy, David W. Embley, Mukkai Krishnamoorthy, Sharad C. Seth

School of Computing: Conference and Workshop Papers

Revealing related content among heterogeneous web tables is part of our long term objective of formulating queries over multiple sources of information. Two hundred HTML tables from institutional web sites are segmented and each table cell is classified according to the fundamental indexing property of row and column headers. The categories that correspond to the multi-dimensional data cube view of a table are extracted by factoring the (often multi-row/column) headers. To reveal commonalities between tables from diverse sources, the Jaccard distances between pairs of category headers (and also table titles) are computed. We show how about one third of our …

A Generalized Service Replication Process In Distributed Environments, Hany F. Elyamany, Marwa F. Mohamed, Katarina Grolinger, Miriam Am Capretz

Electrical and Computer Engineering Publications

Replication is one of the main techniques aiming to improve Web services’ (WS) quality of service (QoS) in distributed environments, including clouds and mobile devices. Service replication is a way of improving WS performance and availability by creating several copies or replicas of Web services which work in parallel or sequentially under defined circumstances. In this paper, a generalized replication process for distributed environments is discussed based on established replication studies. The generalized replication process consists of three main steps: sensing the environment characteristics, determining the replication strategy, and implementing the selected replication strategy. To demonstrate application of the generalized …

Evaluation Of Tcp Header Fields For Data Overhead Efficiency, Justin K. Yirka

UROP Posters

Bandwidth across the internet is constricted by monetary factors and hardware development, so researchers are left to improve the efficiency of data transmitted in order to improve internet speeds. The transmission control protocol (TCP) is the primary transport protocol on the modern internet, ensuring reliable delivery of the majority of data transmitted. I evaluated the TCP header fields for efficient use of data overhead so as to determine current waste and to suggest possible areas for revision. I examined original specifications for TCP mechanisms, comparing them to modern implementations as determined by updated standards and modern practices in the networking …

Positive Fragments Of Coalgebraic Logics, Adriana Balan, Alexander Kurz, Jirí Velebil

Engineering Faculty Articles and Research

Positive modal logic was introduced in an influential 1995 paper of Dunn as the positive fragment of standard modal logic. His completeness result consists of an axiomatization that derives all modal formulas that are valid on all Kripke frames and are built only from atomic propositions, conjunction, disjunction, box and diamond. In this paper, we provide a coalgebraic analysis of this theorem, which not only gives a conceptual proof based on duality theory, but also generalizes Dunn's result from Kripke frames to coalgebras for weak-pullback preserving functors. To facilitate this analysis we prove a number of category theoretic results on …

Presenting Distributive Laws, Marcello M. Bonsangue, Helle H. Hansen, Alexander Kurz, Jurriaan Rot

Engineering Faculty Articles and Research

Distributive laws of a monad T over a functor F are categorical tools for specifying algebra-coalgebra interaction. They proved to be important for solving systems of corecursive equations, for the specification of well-behaved structural operational semantics and, more recently, also for enhancements of the bisimulation proof method. If T is a free monad, then such distributive laws correspond to simple natural transformations. However, when T is not free it can be rather difficult to prove the defining axioms of a distributive law. In this paper we describe how to obtain a distributive law for a monad with an equational presentation …

Extensions Of Functors From Set To V-Cat, Adriana Balan, Alexander Kurz, Jirí Velebil

Engineering Faculty Articles and Research

We show that for a commutative quantale V every functor Set --> V-cat has an enriched left- Kan extension. As a consequence, coalgebras over Set are subsumed by coalgebras over V-cat. Moreover, one can build functors on V-cat by equipping Set-functors with a metric.

Coalgebraic Semantics Of Reflexive Economics (Dagstuhl Seminar 15042), Samson Abramsky, Alexander Kurz, Pierre Lescanne, Viktor Winschel

Engineering Faculty Articles and Research

This report documents the program and the outcomes of Dagstuhl Seminar 15042 “Coalgebraic Semantics of Reflexive Economics”.

Approximation Of Nested Fixpoints, Alexander Kurz

Engineering Faculty Articles and Research

The question addressed in this paper is how to correctly approximate infinite data given by systems of simultaneous corecursive definitions. We devise a categorical framework for reasoning about regular datatypes, that is, datatypes closed under products, coproducts and fixpoints. We argue that the right methodology is on one hand coalgebraic (to deal with possible nontermination and infinite data) and on the other hand 2-categorical (to deal with parameters in a disciplined manner). We prove a coalgebraic version of Bekic lemma that allows us to reduce simultaneous fixpoints to a single fix point. Thus a possibly infinite object of interest is …

Synthesis Of Irreversible Incompletely Specified Multi-Output Functions To Reversible Eosops Circuits With Pse Gates, Robert Adrian Fiszer

Dissertations and Theses

As quantum computers edge closer to viability, it becomes necessary to create logic synthesis and minimization algorithms that take into account the particular aspects of quantum computers that differentiate them from classical computers. Since quantum computers can be functionally described as reversible computers with superposition and entanglement, both advances in reversible synthesis and increased utilization of superposition and entanglement in quantum algorithms will increase the power of quantum computing.

One necessary component of any practical quantum computer is the computation of irreversible functions. However, very little work has been done on algorithms that synthesize and minimize irreversible functions into a …

Cubic Spline Interpolation By Solving A Recurrence Equation Instead Of A Tridiagonal Matrix, Peter Revesz

School of Computing: Conference and Workshop Papers

The cubic spline interpolation method is proba- bly the most widely-used polynomial interpolation method for functions of one variable. However, the cubic spline method requires solving a tridiagonal matrix-vector equation with an O(n) computational time complexity where n is the number of data measurements. Even an O(n) time complexity may be too much in some time-ciritical applications, such as continuously estimating and updating the flight paths of moving objects. This paper shows that under certain boundary conditions the tridiagonal matrix solving step of the cubic spline method could be entirely eliminated and instead the coefficients of the unknown cubic polynomials …

A Game-Theoretic Analysis Of The Nuclear Non-Proliferation Treaty, Peter Revesz

School of Computing: Conference and Workshop Papers

Although nuclear non-proliferation is an almost universal human desire, in practice, the negotiated treaties appear unable to prevent the steady growth of the number of states that have nuclear weapons. We propose a computational model for understanding the complex issues behind nuclear arms negotiations, the motivations of various states to enter a nuclear weapons program and the ways to diffuse crisis situations.

Designing A Bayer Filter With Smooth Hue Transition Interpolation Using The Xilinx System Generator, Zhiqiang Li, Peter Revesz

School of Computing: Conference and Workshop Papers

This paper describes the design of a Bayer filter with smooth hue transition using the System Generator for DSP. We describe and compare experimentally two different designs, one based on a MATLAB implementation and the other based on a modification of the Bayer filter using bilinear interpolation.

Estimating The Flight Path Of Moving Objects Based On Acceleration Data, Peter Revesz

School of Computing: Conference and Workshop Papers

Inertial navigation is the problem of estimating the flight path of a moving object based on only acceleration measurements. This paper describes and compares two approaches for inertial navigation. Both approaches estimate the flight path of the moving object using cubic spline interpolation, but they find the coefficients of the cubic spline pieces by different methods. The first approach uses a tridiagonal matrix, while the second approach uses recurrence equations. They also require different boundary conditions. While both approaches work in O(n) time where n is the number of given acceleration measurements, the recurrence equation-based method can be easier updated …

A Knowledge Discovery Approach For The Detection Of Power Grid State Variable Attacks, Nathan Wallace

Doctoral Dissertations

As the level of sophistication in power system technologies increases, the amount of system state parameters being recorded also increases. This data not only provides an opportunity for monitoring and diagnostics of a power system, but it also creates an environment wherein security can be maintained. Being able to extract relevant information from this pool of data is one of the key challenges still yet to be obtained in the smart grid. The potential exists for the creation of innovative power grid cybersecurity applications, which harness the information gained from advanced analytics. Such analytics can be based on the extraction …

Regen: Optimizing Genetic Selection Algorithms For Heterogeneous Computing, Scott Kenneth Swinkleb Winkleblack

Master's Theses

GenSel is a genetic selection analysis tool used to determine which genetic markers are informational for a given trait. Performing genetic selection related analyses is a time consuming and computationally expensive task. Due to an expected increase in the number of genotyped individuals, analysis times will increase dramatically. Therefore, optimization efforts must be made to keep analysis times reasonable.

This thesis focuses on optimizing one of GenSel’s underlying algorithms for heterogeneous computing. The resulting algorithm exposes task-level parallelism and data-level parallelism present but inaccessible in the original algorithm. The heterogeneous computing solution, ReGen, outperforms the optimized CPU implementation achieving a …

A Comparison Of Image Processing Techniques For Bird Detection, Elsa Reyes

Master's Theses

Orchard fruits and vegetable crops are vulnerable to wild birds and animals. These wild birds and animals can cause critical damage to the produce. Traditional methods of scaring away birds such as scarecrows are not long-term solutions but short-term solutions. This is a huge problem especially near areas like San Luis Obispo where there are vineyards. Bird damage can be as high as 50% for grapes being grown in vineyards. The total estimated revenue lost annually in the 10 counties in California due to bird and rodent damage to 22 selected crops ranged from $168 million to $504 million (in …

Hot Zone Identification: Analyzing Effects Of Data Sampling On Spam Clustering, Rasib Khan, Mainul Mizan, Ragib Hasan, Alan Sprague

Annual ADFSL Conference on Digital Forensics, Security and Law

Email is the most common and comparatively the most efficient means of exchanging information in today's world. However, given the widespread use of emails in all sectors, they have been the target of spammers since the beginning. Filtering spam emails has now led to critical actions such as forensic activities based on mining spam email. The data mine for spam emails at the University of Alabama at Birmingham is considered to be one of the most prominent resources for mining and identifying spam sources. It is a widely researched repository used by researchers from different global organizations. The usual process …

Investigative Techniques Of N-Way Vendor Agreement And Network Analysis Demonstrated With Fake Antivirus, Gary Warner, Mike Nagy, Kyle Jones, Kevin Mitchem

Annual ADFSL Conference on Digital Forensics, Security and Law

Fake AntiVirus (FakeAV) malware experienced a resurgence in the fall of 2013 after falling out of favor after several high profile arrests. FakeAV presents two unique challenges to investigators. First, because each criminal organization running a FakeAV affiliate system regularly alters the appearance of their system, it is sometimes difficult to know whether an incoming criminal complaint or malware sample is related to one ring or the other. Secondly, because FakeAV is delivered in a “Pay Per Install” affiliate model, in addition to the ring-leaders of each major ring, there are many high-volume malware infection rings who are all using …

Work In Progress: An Architecture For Network Path Reconstruction Via Backtraced Ospf Lsdb Synchronization, Raymond A. Hansen

Annual ADFSL Conference on Digital Forensics, Security and Law

There has been extensive work in crime scene reconstruction of physical locations, and much is known in terms of digital forensics of computing devices. However, the network has remained a nebulous combination of entities that are largely ignored during an investigation due to the transient nature of the data that flows through the networks. This paper introduces an architecture for network path reconstruction using the network layer reachability information shared via OSPF Link State Advertisements and the routines and functions of OSPF::rt_sched() as applied to the construction of identical Link State Databases for all routers within an Area.

Application Of Toral Automorphisms To Preserve Confidentiality Principle In Video Live Streaming, Enrique García-Carbajal, Clara Cruz-Ramos, Mariko Nakano-Miyatake

Annual ADFSL Conference on Digital Forensics, Security and Law

Most of the Live Video Systems do not preserve the Confidentiality principle, and send all frames of the video without any protection, allowing an easy “man in the middle” attack. But when it does, it uses cryptographic techniques over streaming data or makes use of secure channel systems. This generates low frame rate and demands many processor resources. In fact native Live Video Streaming demands many resources of all System.

In this paper we propose a technique to preserve confidentiality in Video Live Streaming applying a confusing visual method making use of the Toral Automorphism Spatial Transformation over each frame. …