Advances in Digital Forensics XIV

Name: Advances in Digital Forensics XIV | 14th IFIP WG 11.9 International Conference, New Delhi, India, January 3-5, 2018, Revised Selected Papers
Brand: Springer
Price: 53.49 EUR
Availability: OnlineOnly

14th IFIP WG 11.9 International Conference, New Delhi, India, January 3-5, 2018, Revised Selected Papers

Gilbert Peterson Sujeet Shenoi(Herausgeber*in)

Springer (Verlag)

Erschienen am 29. August 2018

XVIII, 367 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-319-99277-8 (ISBN)

53,49 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

ADVANCES IN DIGITAL FORENSICS XIV
Edited by: Gilbert Peterson and Sujeet Shenoi

Digital forensics deals with the acquisition, preservation, examination, analysis and presentation of electronic evidence. Computer networks, cloud computing, smartphones, embedded devices and the Internet of Things have expanded the role of digital forensics beyond traditional computer crime investigations. Practically every crime now involves some aspect of digital evidence; digital forensics provides the techniques and tools to articulate this evidence in legal proceedings. Digital forensics also has myriad intelligence applications; furthermore, it has a vital role in information assurance - investigations of security breaches yield valuable information that can be used to design more secure and resilient systems.

Advances in Digital Forensics XIV describes original research results and innovative applications in the discipline of digital forensics. In addition, it highlights some of the major technical and legal issues related to digital evidence and electronic crime investigations. The areas of coverage include: Themes and Issues; Forensic Techniques; Network Forensics; Cloud Forensics; and Mobile and Embedded Device Forensics.

This book is the fourteenth volume in the annual series produced by the International Federation for Information Processing (IFIP) Working Group 11.9 on Digital Forensics, an international community of scientists, engineers and practitioners dedicated to advancing the state of the art of research and practice in digital forensics. The book contains a selection of nineteen edited papers from the Fourteenth Annual IFIP WG 11.9 International Conference on Digital Forensics, held in New Delhi, India in the winter of 2018.

Advances in Digital Forensics XIV is an important resource for researchers, faculty members and graduate students, as well as for practitioners and individuals engaged in research and development efforts for the law enforcement and intelligence communities.

Gilbert Peterson, Chair, IFIP WG 11.9 on Digital Forensics, is a Professor of Computer Engineering at the Air Force Institute of Technology, Wright-Patterson Air Force Base, Ohio, USA.

Sujeet Shenoi is the F.P. Walter Professor of Computer Science and a Professor of Chemical Engineering at the University of Tulsa, Tulsa, Oklahoma, USA.

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Contents
Contributing Authors
Preface
THEMES AND ISSUES
MEASURING EVIDENTIAL WEIGHT INDIGITAL FORENSIC INVESTIGATIONS
Abstract
Keywords
1. Introduction
2. Methodology
3. Results and Discussion
4. Conclusions
References
CHALLENGES, OPPORTUNITIESAND A FRAMEWORK FORWEB ENVIRONMENT FORENSICS
Abstract
Keywords
1. Introduction
2. Motivating Scenario
3. Unique Forensic Challenges
3.1 Rule of Completeness (C0)
3.2 Associating Online Personas (C1)
3.3 Evidence Access (C2)
3.4 Relevant Context (C3)
3.5 Tool Integration (C4)
4. Web Environment Forensics Framework
4.1 Evidence Discovery and Acquisition (F1)
4.2 Analysis Space Reduction (F2)
4.3 Timeline Reconstruction (F3)
4.4 Structured Formats (F4)
5. Related Work
6. Conclusions
Acknowledgement
References
INTERNET OF THINGS FORENSICS -CHALLENGES AND A CASE STUDY
Abstract
Keywords
1. Introduction
2. Internet of Things Forensics
2.1 Forensic Challenges
2.2 Forensic Tool Limitations
3. Smartwatch Forensics Case Study
3.1 Logical Acquisition
3.2 Manual Acquisition
4. Conclusions
References
FORENSIC TECHNIQUES
RECOVERY OF FORENSIC ARTIFACTSFROM DELETED JUMP LISTS
Abstract
Keywords
1. Introduction
2. Jump Lists in Digital Forensics
3. Locations and Structures of Jump Lists
4. Experiments and Results
4.1 Experimental Objectives
4.2 Experimental Methodology
4.3 Experimental Set-Up
4.4 Artifacts in AutoDest Jump Lists
5. Conclusions
References
OBTAINING PRECISION-RECALLTRADE-OFFS IN FUZZY SEARCHESOF LARGE EMAIL CORPORA
Abstract
Keywords
1. Introduction
2. Background
2.1 Approximate String Matching Automata
2.2 NFA Definition
2.3 Bit-Parallel Implementation
2.4 Evaluation
3. Experimental Methodology
3.1 Interpreting Match Results
4. Experimental Results
4.1 Precision and Recall
4.2 Execution Time
4.3 Analysis and Suggestions
5. Related Work
6. Conclusions
Acknowledgement
References
ANTI-FORENSIC CAPACITY ANDDETECTION RATING OF HIDDENDATA IN THE Ext4 FILESYSTEM
Abstract
Keywords
1. Introduction
2. Background
2.1 Anti-Forensics
2.2 Ext4 Filesystem Layout
3. Evaluation Methodology
4. Hiding Methods Based on Previous Research
4.1 File and Directory Slack Space
4.2 Null Directory Entries
4.3 Partition Boot Sector
4.4 Superblock: Slack Space
4.5 Superblock: Reserved Space
4.6 Superblock: Backup Copies
4.7 Group Descriptor Table: Slack Space
4.8 Block Group Descriptor: Reserved Space
4.9 Inode Table: Reserved Inodes
4.10 Inode: Reserved Space
5. New Hiding Methods
5.1 Block Bitmap: Slack Space
5.2 Inode Bitmap: Slack Space
5.3 Inode: Slack Space/Extended Attributes
5.4 Inode: Nanosecond Timestamps
5.5 Group Descriptor Table: Backup Copies
5.6 Group Descriptor Table: Growth Blocks
5.7 Extent: Persistent Preallocation
5.8 Uninitialized Block Groups
6. Conclusions
Acknowledgement
References
DETECTING DATA LEAKAGEFROM HARD COPY DOCUMENTS
Abstract
Keywords
1. Introduction
2. Related Work
3. Methodology Overview
3.1 Document Generation
3.2 Source Identification
4. Experimental Setup
5. Technical Details
5.1 Document Generation
5.2 Source Identification
6. Experimental Results
6.1 Optical Character Recognition
6.2 Machine-Learning-Based Classification
7. Conclusions
References
NETWORK FORENSICS
INFORMATION-ENTROPY-BASEDDNS TUNNEL PREDICTION
Abstract
Keywords
1. Introduction
2. Background and Related Work
3. DNS Tunnel Internals and Dataset Collection
3.1 Tunneling with Iodine
3.2 DNS Tunneling Setup and Dataset Capture
4. Protocol Feature Trends and Analysis
4.1 Experimenting with Information Entropy
4.2 Comparison of Plain and Tunneled Protocols
5. Protocol Prediction Experiments
5.1 Results
5.2 Discussion
6. Conclusions
References
COLLECTING NETWORK EVIDENCEUSING CONSTRAINED APPROXIMATESEARCH ALGORITHMS
Abstract
Keywords
1. Introduction
2. Evidence Detection Using Snort
3. Row-Based Bit-Parallelism
4. Constrained Approximate Search
5. Modified CRBP-OpCount Algorithm
6. Experimental Results
6.1 Evading Snort with a Buffer Overflow
6.2 Evading Snort with SQL Injection
6.3 Detecting Similar Attack Patterns
7. Discussion
8. Conclusions
References
TRAFFIC CLASSIFICATION ANDAPPLICATION IDENTIFICATIONIN NETWORK FORENSICS
Abstract
Keywords
1. Introduction
2. Data Collection and Preprocessing
2.1 Application Conversations and Messages
3. Classification Methods
3.1 Feature Set
3.2 Enhanced Statistical Protocol Identification
3.3 Bayesian Network Classifier
3.4 Random Forests Classifier
4. Experimental Procedures and Results
4.1 Experimental Procedures
4.2 Experimental Results
5. Conclusions
References
ENABLING NON-EXPERT ANALYSIS OFLARGE VOLUMES OF INTERCEPTEDNETWORK TRAFFIC
Abstract
Keywords
1. Introduction
2. Background
2.1 Network Forensic Analysis Tools
2.2 Traffic Metadata Analysis Tools
3. Network Intell System
3.1 System Requirements
3.2 System Design
4. System Implementation
5. System Evaluation
6. Conclusions
References
HASHING INCOMPLETE ANDUNORDERED NETWORK STREAMS
Abstract
Keywords
1. Introduction
2. Preliminaries
2.1 Fuzzy Hashing
2.2 Tillich-Z´emor Hash
3. Challenges
4. Stream Fuzzy Hashing Algorithm
4.1 Overview
4.2 Segment Contexts
4.3 Context Updating
4.4 Context Merging
4.5 Block Size Tuning
4.6 Signature Generation
5. Signature Comparison
5.1 Partial File Matching
5.2 Comparing Massive Numbers of Files
6. Evaluation
6.1 Correctness
6.2 Hashing Speed for Sequential Inputs
6.3 Hashing Speed for Unordered Inputs
6.4 Comparison of Incomplete Files
6.5 Stream Fuzzy Hash Algorithm Deployment
7. Related Work
8. Stream Fuzzy Hash Algorithm Limitations
9. Conclusions
Acknowledgements
References
A NETWORK FORENSIC SCHEMEUSING CORRENTROPY-VARIATIONFOR ATTACK DETECTION
Abstract
Keywords
1. Introduction
2. Related Work
3. Network Forensic Scheme
3.1 Capturing and Storing Network Data
3.2 Feature Selection
3.3 Correntropy-Variation Technique
4. Results and Discussion
4.1 Dataset and Evaluation Metrics
4.2 Pre-Processing and Feature Selection
4.3 Network Forensic Evaluation
5. Conclusions
References
CLOUD FORENSICS
A TAXONOMY OF CLOUD ENDPOINT FORENSIC TOOLS
Abstract
Keywords
2. Cloud Forensics
3. Taxonomy of Cloud Endpoint Forensic Tools
3.1 Evidence in Endpoint Devices
3.2 Evidence Recoverable via Cloud APIs
4. Cloud Endpoint Forensic Approaches
5. Cloud Endpoint Device Forensic Tools
6. OneDrive Forensics Case Study
7. Conclusions
Acknowledgement
References
A LAYERED GRAPHICAL MODELFOR CLOUD FORENSIC MISSIONATTACK IMPACT ANALYSIS
Abstract
Keywords
1. Introduction
2. Background and Related Work
2.1 Cloud Forensics
2.2 Related Work
3. Graphical Model
3.1 Upper Layer
3.2 Middle Layer
3.3 Lower Layer
3.4 Mappings
3.5 Computing Mission Impacts
4. Case Study
4.1 Experimental Network and Attacks
4.2 Three Levels of Graphs
4.3 Computing Mission Impact
4.4 Reducing Attack Risk
5. Conclusions
References
MOBILE AND EMBEDDEDDEVICE FORENSICS
FORENSIC ANALYSIS OF ANDROID STEGANOGRAPHY APPS
Abstract
Keywords
1. Introduction
2. Related Work
2.1 Steg Detection Approaches
2.2 Reverse Engineering Android Applications
3. Android App Reverse Engineering
3.1 Common Characteristics
3.2 Reverse Engineering Process
4. Case Study
4.1 PixelKnot
4.2 Da Vinci Secret Image
5. Performance Evaluation
5.1 Experimental Setup
5.2 Detection Results
5.3 Discussion
6. Conclusions
Acknowledgements
References
AUTOMATED VULNERABILITYDETECTION IN EMBEDDED DEVICES
Abstract
Keywords
1. Introduction
2. Vulnerability Detection Techniques
2.1 Source-Code-Based Techniques
2.2 Static-Analysis-Based Techniques
2.3 Actual-Execution-Based Techniques
2.4 Symbolic-Execution-Based Techniques
3. Evaluation of Techniques
4. Proposed Methodology
4.1 Design
4.2 Static Analysis Stage
4.3 Execution Preparation Stage
4.4 Symbolic Execution Stage
5. Conclusions
References
A FORENSIC LOGGING SYSTEMFOR SIEMENS PROGRAMMABLELOGIC CONTROLLERS
Abstract
Keywords
1. Introduction
2. Related Work
3. PLC Architecture and Programming
4. Proposed Logging System
5. S7 Communications Protocol
6. Creating Audit Log Records
6.1 Traffic Light Control System
6.2 Liquid Mixing Control System
7. Experimental Results and Discussion
8. Conclusions
References
ENHANCING THE SECURITY ANDFORENSIC CAPABILITIES OFPROGRAMMABLE LOGICCONTROLLERS
Abstract
Keywords
1. Introduction
2. Programmable Logic Controllers
3. Related Work
4. Security and Forensic Challenges
5. Proposed Solution
6. Experimental Methodology and Results
6.1 Experimental Setup
6.2 Attacks
6.3 Performance Impact
7. Discussion
8. Conclusions
References

Systemvoraussetzungen

Als PDF speichern Als Link merken