Graph clustering and anomaly detection of access control log for forensic purposes

Attacks on operating system access control have become a significant and increasingly common problem. This type of security threat is recorded in a forensic artifact such as an authentication log. Forensic investigators will generally examine the log to analyze such incidents. An anomaly is highly correlated to an attacker's attempts to compromise the system. In this paper, we propose a novel method to automatically detect an anomaly in the access control log of an operating system. The logs will be first preprocessed and then clustered using an improved MajorClust algorithm to get a better cluster. This technique provides parameter-free clustering so that it automatically can produce an analysis report for the forensic investigators. The clustering results will be checked for anomalies based on a score that considers some factors such as the total members in a cluster, the frequency of the events in the log file, and the inter-arrival time of a specific activity. We also provide a graph-based visualization of logs to assist the investigators with easy analysis. Experimental results compiled on an open dataset of a Linux authentication log show that the proposed method achieved the accuracy of 83.14% in the authentication log dataset.     

Forensic analysis of Telegram Messenger on Android smartphones

In this paper we present a methodology for the forensic analysis of the artifacts generated on Android smartphones by Telegram Messenger, the official client for the Telegram instant messaging platform, which provides various forms of secure individual and group communication, by means of which both textual and non-textual messages can be exchanged among users, as well as voice calls.Our methodology is based on the design of a set of experiments suitable to elicit the generation of artifacts and their retention on the device storage, and on the use of virtualized smartphones to ensure the generality of the results and the full repeatability of the experiments, so that our findings can be reproduced and validated by a third-party.In this paper we show that, by using the proposed methodology, we are able (a) to identify all the artifacts generated by Telegram Messenger, (b) to decode and interpret each one of them, and (c) to correlate them in order to infer various types of information that cannot be obtained by considering each one of them in isolation.As a result, in this paper we show how to reconstruct the list of contacts, the chronology and contents of the messages that have been exchanged by users, as well as the contents of files that have been sent or received. Furthermore, we show how to determine significant properties of the various chats, groups, and channels in which the user has been involved (e.g., the identifier of the creator, the date of creation, the date of joining, etc.). Finally, we show how to reconstruct the log of the voice calls made or received by the user.Although in this paper we focus on Telegram Messenger, our methodology can be applied to the forensic analysis of any application running on the Android platform.     

Forensic analysis of WeChat on Android smartphones

WeChat is one of the most popular instant-messaging smartphone applications in the world. At the end of 2015, WeChat had 697 million monthly active users from over 200 countries. Although WeChat was designed originally for communication between relatives and friends, its abundant social functions are now also used by criminals for communication, and even for the organization and coordination of criminal acts. Therefore, communication records of social networking services like WeChat extracted from the smartphones of criminals are always the vital digital evidences for the investigation and prosecution of criminal cases. At present, only a few literatures focused on WeChat forensics. This paper describes several common questions that arise in forensic examinations of Android WeChat and provides corresponding technical methods that are useful to address these questions. This paper is intended to provide vital references for the investigators and researchers working on the digital forensics.     

A local variance based approach to alleviate the scene content interference for source camera identification

Identifying the source camera of images is becoming increasingly important nowadays. A popular approach is to use a type of pattern noise called photo-response non-uniformity (PRNU). The noise of image contains the patterns which can be used as a fingerprint. Despite that, the PRNU-based approach is sensitive towards scene content and image intensity. The identification is poor in areas having low or saturated intensity, or in areas with complicated texture. The reliability of different regions is difficult to model in that it depends on the interaction of scene content and the characteristics of the denoising filter used to extract the noise. In this paper, we showed that the local variance of the noise residual can measure the reliability of the pixel for PRNU-based source camera identification. Hence, we proposed to use local variance to characterize the severeness of the scene content artifacts. The local variance is then incorporated to the general matched filter and peak to correlation energy (PCE) detector to provide an optimal framework for signal detection. The proposed method is tested against several state-of-art methods. The experimental results show that the local variance based approach outperformed other state-of-the-art methods in terms of identification accuracy.     

对部分大学生手机上网的实证调查

中国已经步入第六媒介时代。这个时代,手机不仅仅是方便快捷的上网工具,同时也是时尚潮流和流行文化的代表符号。手机上网对于大学生而言更是具有强大的吸引力。为了准确掌握当前大学生手机上网的实际情况,预测大学生手机上网将会带来的社会变化以及人际关系,笔者在2010年7-8月,对杭州、宁波、厦门、重庆、西安、沈阳等高校的部分在校大学生进行了问卷调查,并结合访问情况,对数据进行了分析研究。此次调查得出三个方面的结论：一是手机上网已经成为大学生的基本生活方式;二是现有的手机上网条件决定了大学生对手机上网的喜好;三是大学生对手机上网的认知处在理性实用的范畴之内。     

Assessment of Silicone Polymer Composites for Environmental Forensic Applications: A Proof of Concept Study*

Abstract: This study evaluates the use of polydimethylsiloxane polymer composites (PDMS, Fe–PDMS) as a passive sampling media to preconcentrate analytes found in environmental settings. Samplers were made using commercially available silicone products. The composite samplers were assessed for their sorption properties using Atrazine and Irgarol 1051 as model compounds. The initial study assessed the utility of PDMS sheets as adsorption material by following analyte depletion from spiked water samples by solid‐phase microextraction gas chromatography/mass spectrometry (GC/MS). Follow‐up studies conducted at high and low concentrations using lab manufactured iron‐ PDMS rods (Fe–PDMS) showed effective uptake at differential rates from concentrations ranging between 1 μg/L and 10 μg/L. Adsorption mechanism was reversible, and compounds were recovered from the exposed materials and analyzed by liquid–liquid extraction‐GC/MS. Both composites showed better affinity for Irgarol 1051, 100% removal, than for Atrazine, 30% removal, likely representing their K_OW differences, 3.6 and 2.6, respectively. This “proof of concept” study demonstrates the positive implications for the use of silicon polymer composites as a monitoring tool for environmental forensic purposes.     

移动服务提供商信用评价指标体系构建初探

随着移动商务的迅猛发展,电信市场不断扩张,服务提供商开发的业务种类日益繁多,由此所引发的滥收费用、隐瞒欺诈等信用问题也越发凸显,并逐渐成为制约移动商务发展的瓶颈。本文初步构建了移动服务提供商的信用评价指标体系,并对提高移动服务提供商的信用水平提出了相关建议。     

基于ATT-3000的动态仿真取证技术研究

本文首先介绍了ATT-3000动态仿真取证系统的概念及特点,然后给出了利用该系统进行仿真和密码破解的过程,最后分析了其在仿真系统快速取证方面的典型应用。     

Cascading Bias of Initial Exposure to Information at the Crime Scene to the Subsequent Evaluation of Skeletal Remains,

Thirty‐eight participants took part in a study that investigated the potential cascading effects of initial exposure to extraneous context upon subsequent decision‐making. Participants investigated a mock crime scene, which included the excavation of clandestine burials that had a male skeletal cast dressed either in female or gender neutral clothing. This was followed by a forensic anthropological assessment of the skeletal remains, with a control group assessing the same male skeletal cast without any clothing context. The results indicated that the sex assessment was highly dependent upon the context in which participants were exposed to prior to the analysis. This was especially noticeable in the female clothing context where only one participant determined the male skeletal cast to be male. The results demonstrate the importance of understanding the role of context in forensic anthropology at an early stage of an investigation and its potential cascading effect on subsequent assessments.     

Web Content Management Systems: An Analysis of Forensic Investigatory Challenges

With an increase in the creation and maintenance of personal websites, web content management systems are now frequently utilized. Such systems offer a low cost and simple solution for those seeking to develop an online presence, and subsequently, a platform from which reported defamatory content, abuse, and copyright infringement has been witnessed. This article provides an introductory forensic analysis of the three current most popular web content management systems available, WordPress, Drupal, and Joomla! Test platforms have been created, and their site structures have been examined to provide guidance for forensic practitioners facing investigations of this type. Result's document available metadata for establishing site ownership, user interactions, and stored content following analysis of artifacts including Wordpress's wp_users, and wp_comments tables, Drupal's “watchdog” records, and Joomla!'s _users, and _content tables. Finally, investigatory limitations documenting the difficulties of investigating WCMS usage are noted, and analysis recommendations are offered.