Public Affairs, Public Policy and Public Administration Commons^™

Homeland Security Starts At Home: How The Citizens Of Pa Perceive Core Missions And The Whole-Community Approach To Fostering A Resilient Nation, Alexander Siedschlag

Publications

Content

• Rationale
• Method: PA omnibus poll instrument
• How citizens value homeland security
• What homeland security protects from
• PA citizens on homeland security
• Perceived scope of homeland security
• Who provides homeland security
• Homeland security and daily life
• Conclusions
• General recommendations
• Educational mission considerations

Harnessing Predictive Models For Assisting Network Forensic Investigations Of Dns Tunnels, Irvin Homem, Panagiotis Papapetrou

Annual ADFSL Conference on Digital Forensics, Security and Law

In recent times, DNS tunneling techniques have been used for malicious purposes, however network security mechanisms struggle to detect them. Network forensic analysis has been proven effective, but is slow and effort intensive as Network Forensics Analysis Tools struggle to deal with undocumented or new network tunneling techniques. In this paper, we present a machine learning approach, based on feature subsets of network traffic evidence, to aid forensic analysis through automating the inference of protocols carried within DNS tunneling techniques. We explore four network protocols, namely, HTTP, HTTPS, FTP, and POP3. Three features are extracted from the DNS tunneled traffic: …

Kelihos Botnet: A Never-Ending Saga, Arsh Arora, Max Gannon, Gary Warner

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper investigates the recent behavior of the Kelihos botnet, a spam-sending botnet that accounts for many millions of emails sent each day. The paper demonstrates how a team of students are able to perform a longitudinal malware study, making significant observations and contributions to the understanding of a major botnet using tools and techniques taught in the classroom. From this perspective the paper has two objectives: encouragement and observation. First, by providing insight into the methodology and tools used by student researchers to document and understand a botnet, the paper strives to embolden other academic programs to follow a …

Ethical, Legal, And Social Issues In Homeland Security – What They Are And How To Address Them, Alexander Siedschlag

Publications

Homeland security is a nationwide effort, including all of government across federal, state, local, territorial and tribal tiers; the public and the private sector, and the whole community, with each single citizen. The overarching homeland security vision comprises safeguarding the American way of life and is embedded into the goals of the National Security Strategy that include respect for universal values at home and abroad. It thus is evident that ethical, legal, and social-or ELSI-issues are important to consider. This chapter discusses the origins and essence of ELSI and explores ELSI integration into everyday homeland security. Two defining debates are …

Protecting The Right To Be An American: How Pennsylvanians Perceive Homeland Security, Alexander Siedschlag

Publications

Homeland Security is strategically defined as an enterprise based on a concerted national effort: a nation-wide comprehensive activity, including all of government across federal, state, local, territorial and tribal tiers; the public and the private sector; and the whole community of first responders and vigilant citizens. While Homeland Security in addition to government agencies and the private sector counts on each single citizen as part of the whole-community approach, little is known about how it actually resonates with citizens. [...]almost a quarter (23%) feel Homeland Security to affect their daily lives – such as by ensuring safe and secure neighborhoods; …

Does Isis Satisfy The Criteria Of An Apocalyptic Islamic Cult? An Evidence-Based Historical Qualitative Meta-Analysis, Diane Maye Zorri, Bruce Barron

Publications

The U.S. has been battling ISIS and its forerunners for over two decades; however, ISIS continues to endure and expand. While described as a death cult by some political leaders and other key stakeholders, this assertion received little consideration in the scholarly literature. The purpose of this study was to ascertain whether ISIS satisfied the criteria of an apocalyptic Islamic cult through the application of a historical qualitative research design and meta-analysis. Based on the results, the null hypothesis that ISIS does not satisfy the criteria of an apocalyptic Islamic cult was rejected, and the hypothesis that ISIS satisfies the …

Autarky Or Interdependence? U.S. Vs. European Security And Defense Industries In A Globalized Market, Diane Maye Zorri

Publications

Globalization theorists show how downward pressure to compete and/or

save costs in global markets will lead producers and consumers to source

goods and services in the cheapest and most efficient manner. However, in

certain sectors, such as the defense industry, security concerns and politics

can overshadow economic logic when it comes to making procurement

decisions. These political and security concerns keep the U.S. defense

industry from using the most cost-effective supply chains and

manufacturing centers, whereas in Europe, post-Cold War socioeconomic

and political realities allowed for more transnational cooperation on

defense procurement. Three cases serve to illustrate the spectrum between …

Spaceways: Airspace In Outer Space, Scott Haeffelin

Space Traffic Management Conference

Forecasted future demand in space travel is driving the need for the development of space traffic management. Currently, orbital space traffic is mostly unregulated with internationally agreed upon best practices and self-interest driving space operators to avoid collisions with other spacecraft. This paper explores the future of space travel by presenting a concept of creating “airspace in space” or spaceways to manage the ever growing volumes of space traffic. Spaceways are analogous to airspace for aircraft with the goal of increasing levels of safety and reducing probabilities of collision. These goals can be achieved by creating traffic rules, defining valuable …

Protecting The Right To Be An American: How Pennsylvanians Perceive Homeland Security, Alexander Siedschlag

Publications

Pennsylvanians mainly see Homeland Security as a comprehensive effort of the federal government to fight terrorism at home and abroad. While it most often has a positive connotation, the multi-faceted mission space of homeland security is widely unknown.

Pennsylvania 2016 Pre-Election Poll On Policy And Governance, Alexander Siedschlag

Publications

Pennsylvanians mainly see Homeland Security as a comprehensive effort of the federal government to fight terrorism at home and abroad. While it most often has a positive connotation, the multi-faceted mission space of homeland security is widely unknown.

Emerging Business Models For Commercial Spaceports: Current Trends From The Us Perspective, Janet K. Tinoco, Chunyan Yu

Publications

Agenda for Presentation:

• US Commercial/Government Active Launch Sites
• Why Commercial Spaceports?
• Spaceport Business Model Drivers
• Spaceport Multi-Modal Facility and Infrastructure Requirements
• Emerging Spaceport Business Models
• Summary and Concluding Remarks

Global Threats And Strategic Assessments: Al-Aqsa Martyrs' Brigade An Evolving Terrorism Force, Kaydee Penn

Student Works

The purpose of this report is to present a Foreign Terrorist Organization (FTO) designated by the Secretary of State that poses as a threat to U.S. national interests. This report contains an analysis of current research on the Al-Aqsa Martyrs' Brigade's past, present, and foreseeable status. An investigation into AAMB's past attacks is imminent to thwarting future attacks. This report will provide a method of analysis to identify gaps and trends in Al-Aqsa Martyrs' Brigade's past attacks. The findings from the analysis will pave the way for further research to benefit national security.

Sim Card Forensics: Digital Evidence, Nada Ibrahim, Nuha Al Naqbi, Farkhund Iqbal, Omar Alfandi

Annual ADFSL Conference on Digital Forensics, Security and Law

With the rapid evolution of the smartphone industry, mobile device forensics has become essential in cybercrime investigation. Currently, evidence forensically-retrieved from a mobile device is in the form of call logs, contacts, and SMSs; a mobile forensic investigator should also be aware of the vast amount of user data and network information that are stored in the mobile SIM card such as ICCID, IMSI, and ADN. The aim of this study is to test various forensic tools to effectively gather critical evidence stored on the SIM card. In the first set of experiments, we compare the selected forensic tools in …

Assessing The Gap: Measure The Impact Of Phishing On An Organization, Brad Wardman

Annual ADFSL Conference on Digital Forensics, Security and Law

Phishing has become one of the most recognized words associated with cybercrime. As more organizations are being targeted by phishing campaigns, there are more options within the industry to deter such attacks. However, there is little research into how much damage these campaigns are causing organizations. This paper will show how financial organizations can be impacted by phishing and present a method for accurately quantifying resultant monetary losses. The methodology presented in this paper can be adapted to other organizations in order to quantify phishing losses across industries.

Keywords: phishing, cybercrime, economics

Wban Security Management In Healthcare Enterprise Environments, Karina Bahena, Manghui Tu

Annual ADFSL Conference on Digital Forensics, Security and Law

As healthcare data are pushed online, consumers have raised big concerns on the breach of their personal information. Law and regulations have placed businesses and public organizations under obligations to take actions to prevent such data breaches. Various vulnerabilities have been identified in healthcare enterprise environments, in which the Wireless Body Area Networks (WBAN) remains to be a major vulnerability, which can be easily taken advantage of by determined adversaries. Thus, vulnerabilities of WBAN systems and the effective countermeasure mechanisms to secure WBAN are urgently needed. In this research, first, the architecture of WBAN system has been explored, and the …

Forensics Analysis Of Privacy Of Portable Web Browsers, Ahmad Ghafarian

Annual ADFSL Conference on Digital Forensics, Security and Law

Web browser vendors offer a portable web browser option which is considered as one of the features that provides user privacy. Portable web browser is a browser that can be launched from a USB flash drive without the need for its installation on the host machine. Most popular web browsers have portable versions of their browsers as well. Portable web browsing poses a great challenge to computer forensic investigators who try to reconstruct the past browsing history, in case of any computer incidence. This research examines various sources in the host machine such as physical memory, temporary, recent, event files, …

Reverse Engineering A Nit That Unmasks Tor Users, Matthew Miller, Joshua Stroschein, Ashley Podhradsky

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper is a case study of a forensic investigation of a Network Investigative Technique (NIT) used by the FBI to deanonymize users of a The Onion Router (Tor) Hidden Service. The forensic investigators were hired by the defense to determine how the NIT worked. The defendant was ac- cused of using a browser to access illegal information. The authors analyzed the source code, binary files and logs that were used by the NIT. The analysis was used to validate that the NIT collected only necessary and legally authorized information. This paper outlines the publicly available case details, how the …

Malware In The Mobile Device Android Environment, Diana Hintea, Robert Bird, Andrew Walker

Annual ADFSL Conference on Digital Forensics, Security and Law

exploit smartphone operating systems has exponentially expanded. Android has become the main target to exploit due to having the largest install base amongst the smartphone operating systems and owing to the open access nature in which application installations are permitted. Many Android users are unaware of the risks associated with a malware infection and to what level current malware scanners protect them. This paper tests how efficient the currently available malware scanners are. To achieve this, ten representative Android security products were selected and tested against a set of 5,560 known and categorized Android malware samples. The tests were carried …

Forensic Analysis Of Smartphone Applications For Privacy Leakage, Diana Hintea, Chrysanthi Taramonli, Robert Bird, Rezhna Yusuf

Annual ADFSL Conference on Digital Forensics, Security and Law

Smartphone and tablets are personal devices that have diffused to near universal ubiquity in recent years. As Smartphone users become more privacy-aware and -conscious, research is needed to understand how “leakage” of private information (personally identifiable information – PII) occurs. This study explores how leakage studies in Droid devices should be adapted to Apple iOS devices. The OWASP Zed Attack Proxy (ZAP) is examined for 50 apps in various categories. This study confirms that: (1) most apps transmit unencrypted sensitive PII, (2) SSL is used by some recipient websites, but without corresponding app compliance with SSL, and (3) most apps …

Inferring Previously Uninstalled Applications From Residual Partial Artifacts, Jim Jones, Tahir Khan, Kathryn Laskey, Alex Nelson, Mary Laamanen, Douglas White

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper, we present an approach and experimental results to suggest the past presence of an application after the application has been uninstalled and the system has remained in use. Current techniques rely on the recovery of intact artifacts and traces, e.g., whole files, Windows Registry entries, or log file entries, while our approach requires no intact artifact recovery and leverages trace evidence in the form of residual partial files. In the case of recently uninstalled applications or an instrumented infrastructure, artifacts and traces may be intact and complete. In most cases, however, digital artifacts and traces are al- …

One-Time Pad Encryption Steganography System, Michael J. Pelosi, Gary Kessler, Michael Scott S. Brown

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper we introduce and describe a novel approach to adaptive image steganography which is combined with One-Time Pad encryption, and demonstrate the software which implements this methodology. Testing using the state-of-the-art steganalysis software tool StegExpose concludes the image hiding is reliably secure and undetectable using reasonably-sized message payloads (≤25% message bits per image pixel; bpp). Payload image file format outputs from the software include PNG, BMP, JP2, JXR, J2K, TIFF, and WEBP. A variety of file output formats is empirically important as most steganalysis programs will only accept PNG, BMP, and possibly JPG, as the file inputs.

Keywords: …

Applying Grounded Theory Methods To Digital Forensics Research, Ahmed Almarzooqi, Andrew Jones, Richard Howley

Annual ADFSL Conference on Digital Forensics, Security and Law

Deciding on a suitable research methodology is challenging for researchers. In this paper, grounded theory is presented as a systematic and comprehensive qualitative methodology in the emergent field of digital forensics research. This paper applies grounded theory in a digital forensics research project undertaken to study how organisations build and manage digital forensics capabilities. This paper gives a step-by-step guideline to explain the procedures and techniques of using grounded theory in digital forensics research. The paper gives a detailed explanation of how the three grounded theory coding methods (open, axial, and selective coding) can be used in digital forensics research. …

Covert6: A Tool To Corroborate The Existence Of Ipv6 Covert Channels, Raymond A. Hansen, Lourdes Gino, Dominic Savio

Annual ADFSL Conference on Digital Forensics, Security and Law

Covert channels are any communication channel that can be exploited to transfer information in a manner that violates the system’s security policy. Research in the field has shown that, like many communication channels, IPv4 and the TCP/IP protocol suite have been susceptible to covert channels, which could be exploited to leak data or be used for anonymous communications. With the introduction of IPv6, researchers are acutely aware that many vulnerabilities of IPv4 have been remediated in IPv6. However, a proof of concept covert channel system was demonstrated in 2006. A decade later, IPv6 and its related protocols have undergone major …

Acceleration Of Statistical Detection Of Zero-Day Malware In The Memory Dump Using Cuda-Enabled Gpu Hardware, Igor Korkin, Iwan Nesterow

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper focuses on the anticipatory enhancement of methods of detecting stealth software. Cyber security detection tools are insufficiently powerful to reveal the most recent cyber-attacks which use malware. In this paper, we will present first an idea of the highest stealth malware, as this is the most complicated scenario for detection because it combines both existing anti-forensic techniques together with their potential improvements. Second, we will present new detection methods which are resilient to this hidden prototype. To help solve this detection challenge, we have analyzed Windows’ memory content using a new method of Shannon Entropy calculation; methods of …

Using Computer Behavior Profiles To Differentiate Between Users In A Digital Investigation, Shruti Gupta, Marcus Rogers

Annual ADFSL Conference on Digital Forensics, Security and Law

Most digital crimes involve finding evidence on the computer and then linking it to a suspect using login information, such as a username and a password. However, login information is often shared or compromised. In such a situation, there needs to be a way to identify the user without relying exclusively on login credentials. This paper introduces the concept that users may show behavioral traits which might provide more information about the user on the computer. This hypothesis was tested by conducting an experiment in which subjects were required to perform common tasks on a computer, over multiple sessions. The …

Current Challenges And Future Research Areas For Digital Forensic Investigation, David Lillis, Brett A. Becker, Tadhg O’Sullivan, Mark Scanlon

Annual ADFSL Conference on Digital Forensics, Security and Law

Given the ever-increasing prevalence of technology in modern life, there is a corresponding increase in the likelihood of digital devices being pertinent to a criminal investigation or civil litigation. As a direct consequence, the number of investigations requiring digital forensic expertise is resulting in huge digital evidence backlogs being encountered by law enforcement agencies throughout the world. It can be anticipated that the number of cases requiring digital forensic analysis will greatly increase in the future. It is also likely that each case will require the analysis of an increasing number of devices including computers, smartphones, tablets, cloud-based services, Internet …

Forensic Analysis Of Ares Galaxy Peer-To-Peer Network, Frank Kolenbrander, Nhien-An Le-Khac, Tahar Kechadi

Annual ADFSL Conference on Digital Forensics, Security and Law

Child Abuse Material (CAM) is widely available on P2P networks. Over the last decade several tools were made for 24/7 monitoring of peer-to-peer (P2P) networks to discover suspects that use these networks for downloading and distribution of CAM. For some countries the amount of cases generated by these tools is so great that Law Enforcement (LE) just cannot handle them all. This is not only leading to backlogs and prioritizing of cases but also leading to discussions about the possibility of disrupting these networks and sending warning messages to potential CAM offenders. Recently, investigators are reporting that they are creating …

Keynote Speaker, Chuck Easttom

Annual ADFSL Conference on Digital Forensics, Security and Law

Conference Keynote Speaker, Chuck Easttom

Bullying At The Fire Station? Perceptions Based On Gender, Race And Sexual Orientation, John C. Griffith, Donna L. Roberts, Ronald T. Wakeham

Publications

Discrimination and strained co-worker relationships based on gender, race or sexual orientation are forms of bullying in the workplace. This research examined firefighter perceptions with regard to bullying. The web based survey was distributed through the National Fire Academy Training, Resources and Data Exchange Network, (TRADENET). Findings from 113 surveys indicated that most firefighters did not perceive bullying issues were pervasive in the fire service. However, there were large differences in perception between female and male firefighters. Significantly more female firefighters indicated they were treated differently due to gender, felt their supervisors did not address complaints concerning gender or sexual …

Pilot Perceptions On Impact Of Crew Rest Regulations On Safety And Fatigue, Lukas Rudari, Mary E. Johnson, Robert C. Geske, Lauren A. Sperlak

International Journal of Aviation, Aeronautics, and Aerospace

The risk of fatigue on pilot performance and safety is well recognized in aviation. In response to increased safety concerns, the Federal Aviation Administration addressed fatigue risk for passenger airline pilots in Title 14 Code of Federal Regulations Part 117, which included accommodations to address fatigue related risk-factors such as circadian rhythm and the phenomenon commonly described as jet-lag. The rule became effective in January 2014. A survey was conducted in March and April of 2014 to better understand pilot perceptions of the new Part 117 rule. This study analyzed survey responses from 92 self-identified pilots to determine the effect …