Advances in Digital Forensics XVI

Name: Advances in Digital Forensics XVI | 16th IFIP WG 11.9 International Conference, New Delhi, India, January 6-8, 2020, Revised Selected Papers
Brand: Springer
Price: 96.29 EUR
Availability: OnlineOnly

16th IFIP WG 11.9 International Conference, New Delhi, India, January 6-8, 2020, Revised Selected Papers

Gilbert Peterson Sujeet Shenoi(Herausgeber*in)

Springer (Verlag)

Erschienen am 6. September 2020

XVIII, 308 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-030-56223-6 (ISBN)

96,29 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Contents
Contributing Authors
Preface
I THEMES AND ISSUES
Chapter 1 DIGITAL FORENSICS AND THE BIG DATA DELUGE - SOME CONCERNS BASED ON RAMSEY THEORY
1. Introduction
2. Patterns and Repetition
2.1 Small Correlations
2.2 Patterns and/or Knowledge
2.3 Big Data
3. What Constitutes Correlation?
4. Correlation in Big Data
5. Ramsey Theory
5.1 Finite Ramsey Theorem
5.2 Van der Waerden's Theorem
5.3 Logic of Inference
6. Conclusions
References
Chapter 2 IDENTITY AND SUFFICIENCY OF DIGITAL EVIDENCE
1. Introduction
2. Background
3. Sufficient Evidence of the Act
4. Digital Identity Case Study
4.1 Electronic Fraud Case
4.2 Fraud Case Analysis
4.3 Sufficiency for Identification
5. Authentication and Hearsay Issues
6. Identification in Online Environments
7. Conclusions
References
II FORENSIC TECHNIQUES
Chapter 3 INTERACTIVE TEMPORAL DIGITAL FORENSIC EVENT ANALYSIS
1. Introduction
2. Related Work
3. TAIMA
3.1 Design Principles
3.2 GUI Timeline
3.3 Abstraction Technique
4. Evaluating User Experience
4.1 Study Participants
4.2 Procedure
4.3 Results
5. Conclusions
References
Chapter 4 ENHANCING THE FEATURE PROFILES OF WEB SHELLS BY ANALYZING THE PERFORMANCE OF MULTIPLE DETECTORS
1. Introduction
2. Related Work
3. Proposed Web Shell Detection Method
3.1 Web Shell Feature Extraction
3.2 Learning Model Construction
4. Experiments and Evaluation
4.1 Data Sources and Samples
4.2 Data Processing
4.3 Evaluation of Feature Sets
4.4 Evaluation of Text Vectorization Methods
4.5 Evaluation of Algorithms and Products
5. Conclusions
Acknowledgement
References
Chapter 5 A NOVEL APPROACH FOR GENERATING SYNTHETIC DATASETS FOR DIGITAL FORENSICS
1. Introduction
2. Related Work
3. Framework Architecture and Functionality
3.1 Overview
3.2 Framework Architecture
3.3 Data Synthesis Procedure
3.4 Supported Features
3.5 Network Traffic Synthesizer
3.6 Disk Image Generator
4. Generator and Reporter
4.1 Generator
4.2 Reporter
5. Framework Validation
5.1 Web Traffic and Mail Traffic Generation
5.2 Framework Extensions
6. Future Work
7. Conclusions
Acknowledgements
References
Chapter 6 DETECTING ATTACKS ON A WATER TREATMENT SYSTEM USING ONE-CLASS SUPPORT VECTOR MACHINES
1. Introduction
2. Related Work
3. Secure Water Treatment Testbed
4. Data Collection
5. One-Class Support Vector Machine
6. Methodology
7. Evaluation and Experimental Results
7.1 Evaluation
7.2 Experimental Results
8. Conclusions
Acknowledgement
References
III FILESYSTEM FORENSICS
Chapter 7 A DIGITAL MEDIA SIMILARITY MEASURE FOR TRIAGE OF DIGITAL FORENSIC EVIDENCE
1. Introduction
2. Background
3. Use Cases
4. Previous Work
5. Methodology
5.1 Jaccard Index of Similarity
5.2 Whitelist
5.3 Similarity between Two Drives
5.4 Similarity against a Cluster of Drives
5.5 Similarity with Frequency
5.6 Similarity with Normalized Frequency
6. Validation
6.1 Initial Validation
6.2 Whitelist Sector Removal
6.3 JIWF Computation
6.4 JINF Computation
6.5 JIWF and JINF Comparison
7. Conclusions
References
Chapter 8 RESIDENT DATA PATTERN ANALYSIS USING SECTOR CLUSTERING FOR STORAGE DRIVE FORENSICS
1. Introduction
2. Background and Related Work
2.1 Triage
2.2 Data Reduction
2.3 Clustering
2.4 Extracted Features
2.5 Assumptions
3. Proposed Methodology
4. Experiments and Analysis
4.1 Sector Sample Size
4.2 Significant Region Analysis
4.3 Performance Metrics
4.4 Evaluation Delay
4.5 Error Rate
5. Conclusions
References
IV CLOUD FORENSICS
Chapter 9 FORENSIC ANALYSIS OF ADVANCED PERSISTENT THREAT ATTACKS IN CLOUD ENVIRONMENTS
1. Introduction
2. Background and Related Work
2.1 ATT&CK Knowledge Base
2.2 Cyber Kill Chain Methodology
2.3 Related Work
3. Experimental Cloud Environment Attacks
3.1 Forensic Data Obtained via Forensic Tools
4. Forensic Investigation
4.1 Identifying Forensic Data
4.2 Mapping Log Entries to Attack Steps
4.3 Correlating Attack Steps to APTs
5. Conclusions
References
Chapter 10 A TAXONOMY OF HYPERVISOR FORENSIC TOOLS
1. Introduction
2. Hypervisors
3. Hypervisor Attacks and Vulnerabilities
3.1 System Calls and Hypercalls
3.2 Virtual Machine Introspection
4. Taxonomy of Hypervisor Forensic Tools
4.1 Virtual Machine Layer Data
4.2 Virtual Machine Manager Layer Data
4.3 Network Layer Data
4.4 Host Machine Layer Data
4.5 Hardware Layer Data
5. Related Work
6. KVM Hypervisor Forensics
7. Conclusions
References
V SOCIAL MEDIA FORENSICS
Chapter 11 PUBLIC OPINION MONITORING FOR PROACTIVE CRIME DETECTION USING NAMED ENTITY RECOGNITION
1. Introduction
2. Named Entity Recognition
3. LSTM-CRF Model
4. Related Work
5. Experiments
5.1 Experimental Setup
5.2 Classification of Named Entities
6. Experimental Results and Discussion
7. Conclusions
References
Chapter 12 RETRIEVING E-DATING APPLICATION ARTIFACTS FROM iPHONE BACKUPS
1. Introduction
2. Related Work
3. Challenges
4. Evidence Extraction Methods
4.1 Tinder
4.2 Coffee Meets Bagel
5. Experimental Evaluation
5.1 Tinder Evidence
5.2 Coffee Meets Bagel Evidence
6. Conclusions
References
VI MULTIMEDIA FORENSICS
Chapter 13 TARGET IDENTITY ATTACKS ON FACIAL RECOGNITION SYSTEMS
1. Introduction
2. Related Work
3. Target Identity Attacks
4. Experiments and Results
4.1 Implementation Details
4.2 Attack Performance Evaluation
5. Conclusions
References
Chapter 14 ELECTRIC NETWORK FREQUENCY BASED AUDIO FORENSICS USING CONVOLUTIONAL NEURAL NETWORKS
1. Introduction
2. Related Work
3. System Model
4. ENF-Based Forensics with CNN
5. Experiments and Results
5.1 Experimental Setup
5.2 Detection Performance
5.3 Results for Different SNR Conditions
6. Conclusions
Acknowledgement
References
VII NOVEL APPLICATIONS
Chapter 15 INSIDER THREAT DETECTION USING MULTI-AUTOENCODER FILTERING AND UNSUPERVISED LEARNING
Introduction
2. Related Work
3. Multi-Autoencoder Detection Framework
3.1 Problem Statement
3.2 Multi-Autoencoder Filtering
3.3 Insider Threat Prediction
3.4 Framework Workflow
4. Framework Evaluation
4.1 Multi-Autoencoder Filtering Performance
4.2 Comparison Against Baseline Methods
5. Conclusions
References
Chapter 16 DETECTING LOCAL MACHINE DATA LEAKAGE IN REAL TIME
1. Introduction
2. Related Work
3. String Matching with a Suffix Array
3.1 Suffix Array
3.2 Multi-Pattern Matching
4. Implementation and Evaluation
4.1 Comparison with Other Methods
4.2 Enron Email Corpus Experiments
5. Discussion and Analysis
6. Conclusions
References

Systemvoraussetzungen

Als PDF speichern Als Link merken