Cloud Data Imager: A unified answer to remote acquisition of cloud storage areas

The pervasive availability of cheap cloud computing services for data storage, either as persistence layer to applications or as mere object store dedicated to final users, is remarkably increasing the chance that cloud platforms potentially host evidence of criminal activity. Once presented a proper court order, cloud providers would be in the best position for extracting relevant data from their platforms in the most reliable and complete way. However, this kind of services are not so widespread to date and, therefore, the need to adopt a structured and forensically sound approach calls for innovative weaponry which leverage the data harvesting capabilities offered by the low level program interfaces exposed by providers. This paper describes the concepts and internals of the Cloud Data Imager Library, a mediation layer that offers a read only access to files and metadata of selected remote folders and currently supports access to Dropbox, Google Drive and Microsoft Skydrive storage facilities. A demo application has been build on top of the library which allows directory browsing, file content view and imaging of folder trees with export to widespread forensic formats.     

Modelling and refinement of forensic data acquisition specifications

This paper defines a model of a special type of digital forensics tools, known as data acquisition tools, using the formal refinement language Event-B. The complexity and criticality of many types of computer and Cyber crime nowadays combined with improper or incorrect use of digital forensic tools calls for more robust and reliable specifications of the functionality of digital forensics applications. As a minimum, the evidence produced by such tools must meet the minimum admissibility standards the legal system requires, in general implying that it must be generated from reliable and robust tools. Despite the fact that some research and effort has been spent on the validation of digital forensics tools by means of testing, the verification of such tools and the formal specification of their expected behaviour remains largely under-researched. The goal of this work is to provide a formal specification against which implementations of data acquisition procedures can be analysed.     

青少年网络犯罪预防初探

网民中青少年最多,青少年网络犯罪在网络犯罪中亦占有很大的比重。因此,有效地预防青少年网络犯罪是预防网络犯罪的关键。只有建立结构化预防体系、加强计算机网络技术方面的建设、加强相关的法律法规保障、加强国际间的合作,才能从根本上预防青少年网络犯罪的发生和蔓延。     

论网络时代侦查模式的转变

从侦查途径来看,“从事到人”曾经是一种主要的侦查模式。网络的迅猛发展,使得犯罪案件与作案人分处于虚拟与物理两大空间,计算机充当着犯罪“帮凶”的角色,因此侦查模式必然转变为“事———机———人”模式。这种新型模式不仅适用于网络犯罪的侦查,对部分传统犯罪的侦查亦具有应用价值。     

网络的发展对我国政治安全机制的冲击

网络的发展使我国政治安全机制的各个层面面临巨大冲击,主要表现是网络成员身份数字化、电子化,安全工作对象变得难以识别和掌握;网络使政府对信息的控制力下降,统一舆论难以再续;网络催生全球化理念的张扬,国家和民族意识趋于淡化;网络成为少数西方国家对我国进行"和平演变"的工具,防腐反侵难度加大;网络开辟了信息窃取和破坏的新途径,政治安全防范面临全新挑战.面对上述冲击,我们必须居安思危,未雨绸缪,在实践中不断探索和完善我国的政治安全机制.     

论计算机人像组合技术

计算机人像组合技术成像质量明显优于手工绘制的模拟画像,操作简便,易于掌握推广,能为侦查破案发挥重要作用。     

论公安院校大学生计算机网络能力的培养与提高

公安工作信息化是“科技强警”战略的重要举措,是公安机关的警务工作由传统模式向计算机网络化工作模式的重大转变,培养与提高公安院校大学生计算机网络能力是公安工作信息化的必然要求。同时也是公安实战中遏制网络犯罪的迫切要求。为此,公安教育要突出公安院校计算机基础教育特点,夯实学生基础知识和基本技能;密切联系公安工作实际,增强计算机网络使用能力;贴近公安实战,拓宽视野,提高学生计算机网络及计算机犯罪的知识三个方面是培养与提高公安院校大学生计算机网络能力的方式和途径。     

刑事弹道计算机分析系统的研究

本文介绍了刑事弹道计算机分析系统的原理和方法,利用该系统,给定发射角或入射角以及枪种,可自动计算出弹道上任意一点处的射程、射高、射角、速率以及动能等参数.     

iCOP: Live forensics to reveal previously unknown criminal media on P2P networks

The increasing levels of criminal media being shared in peer-to-peer (P2P) networks pose a significant challenge to law enforcement agencies. One of the main priorities for P2P investigators is to identify cases where a user is actively engaged in the production of child sexual abuse (CSA) media – they can be indicators of recent or on-going child abuse. Although a number of P2P monitoring tools exist to detect paedophile activity in such networks, they typically rely on hash value databases of known CSA media. As a result, these tools are not able to adequately triage the thousands of results they retrieve, nor can they identify new child abuse media that are being released on to a network. In this paper, we present a new intelligent forensics approach that incorporates the advantages of artificial intelligence and machine learning theory to automatically flag new/previously unseen CSA media to investigators. Additionally, the research was extensively discussed with law enforcement cybercrime specialists from different European countries and Interpol. The approach has been implemented into the iCOP toolkit, a software package that is designed to perform live forensic analysis on a P2P network environment. In addition, the system offers secondary features, such as showing on-line sharers of known CSA files and the ability to see other files shared by the same GUID or other IP addresses used by the same P2P client. Finally, our evaluation on real CSA case data shows high degrees of accuracy, while hands-on trials with law enforcement officers demonstrate the toolkit's complementarity to extant investigative workflows.     

基于网络环境的研究生培养机制研究

研究生培养机制改革与创新是新时期我国研究生教育与管理的一项重要内容。以网络技术和多媒体教学为主要特征的信息时代的到来,给研究生培养机制带来了深刻的变革,赋予研究生培养机制以新的特点和新的发展趋势,并给其教育与管理带来了双面影响。我们可以充分依托和发挥网络环境的巨大优势,通过研究生和培养单位的双向努力,共同构建研究生培养机制的网络化、现代化、国际化和谐化。