Digital Forensic Applications Research Articles

Exploiting Geometrical Structure for Forensic Applications of Timing Inference Channels

Timing inference channels are a well-studied area of computer security and privacy research, but they have not been widely applied in digital forensic applications. Timing signatures (for example, of movies) are not robust against variations in the machine, the encoder, the environment, and other factors that affect timing, and unfortunately such issues have limited many researchers from using timing inference channels for revealing hidden data, detecting machine behavior, or even forensic analysis. The authors develop a geometrical interpretation in a high dimensional space of timing signatures for movies as an example of pattern-like software. The results suggest that timing signatures can be made robust against different machines, different encoders, and other environmental conditions by exploiting geometrical structure in this space. This geometrical structure helps identify the behavior of running pattern-like software that is useful for identifying digital crimes, privacy invasion matters, and network behaviors. This paper is focused on a thought experiment: how much information can an unprivileged process learn by just running on a system and observing its own timing? Although installing administrative software is the most frequent approach for understanding system behavior and detecting running software, the results show that it is feasible that such goals could be still achieved without any administrative privileges.

Data Mining : A Prospective Approach for Digital Forensics

Data mining is part of the interdisciplinary field of knowledge discovery in databases. Research on data mining began in the 1980s and grew rapidly in the 1990s.Specific techniques that have been developed within disciplines such as artificial intelligence, machine learning and pattern recognition have been successfully employed in data mining. Data mining has been successfully introduced in many different fields. An important application area for data mining techniques is the World Wide Web Recently, data mining techniques have also being applied to the field of criminal forensics nothing but Digital forensics. Examples include detecting deceptive criminal identities, identifying groups of criminals who are engaging in various illegal activities and many more. Data mining techniques typically aim to produce insight from large volumes of data. Digital forensics is a sophisticated and cutting edge area of breakthrough research. Canvass of digital forensic investigation and application is growing at a rapid rate with mammoth digitization of an information economy. Law enforcement and military organizations have heavy reliance on digital forensic today. As information age is revolutionizing at a speed inconceivable and information being stored in digital form, the need for accurate intellectual interception, timely retrieval, and nearly zero fault processing of digital data is crux of the issue. This research paper will focus on role of data mining techniques for digital forensics. It also identifies how Data mining techniques can be applicable in the field of digital forensics that will enable forensic investigator to reach the first step in effective prosecution, namely charge-sheeting of digital crime cases.

Color-Decoupled Photo Response Non-Uniformity for Digital Image Forensics

The last few years have seen the use of photo response non-uniformity noise (PRNU), a unique fingerprint of imaging sensors, in various digital forensic applications such as source device identification, content integrity verification, and authentication. However, the use of a color filter array for capturing only one of the three color components per pixel introduces color interpolation noise, while the existing methods for extracting PRNU provide no effective means for addressing this issue. Because the artificial colors obtained through the color interpolation process are not directly acquired from the scene by physical hardware, we expect that the PRNU extracted from the physical components, which are free from interpolation noise, should be more reliable than that from the artificial channels, which carry interpolation noise. Based on this assumption we propose a couple-decoupled PRNU (CD-PRNU) extraction method, which first decomposes each color channel into four sub-images and then extracts the PRNU noise from each sub-image. The PRNU noise patterns of the sub-images are then assembled to get the CD-PRNU. This new method can prevent the interpolation noise from propagating into the physical components, thus improving the accuracy of device identification and image content integrity verification.

An Enhanced Fuzzy ARM Approach for Intrusion Detection

The integration of fuzzy logic with data mining methods such as association rules has achieved interesting results in various digital forensics applications. As a data mining technique, the association rule mining (ARM) algorithm uses ranges to convert any quantitative features into categorical ones. Such features lead to the sudden boundary problem, which can be smoothed by incorporating fuzzy logic so as to develop interesting patterns for intrusion detection. This paper introduces a Fuzzy ARM-based intrusion detection model that is tested on the CAIDA 2007 backscatter network traffic dataset. Moreover, the authors present an improved algorithm named Matrix Fuzzy ARM algorithm for mining fuzzy association rules. The experiments and results that are presented in this paper demonstrate the effectiveness of integrating fuzzy logic with association rule mining in intrusion detection. The performance of the developed detection model is improved by using this integrated approach and improved algorithm.

A Data Mining Approach for Data Generation and Analysis for Digital Forensic Application

With the rapid advancements in information and communication technology in the world, crimes committed are becoming technically intensive. When crimes committed use digital devices, forensic examiners have to adopt practical frameworks and methods to recover data for analysis which can pose as evidence. Data Generation, Data Warehousing and Data Mining, are the three essential features involved in the investigation process. This paper proposes a unique way of generating, storing and analyzing data, retrieved from digital devices which pose as evidence in forensic analysis. A statistical approach is used in validating the reliability of the pre-processed data. This work proposes a practical framework for digital forensics on flash drives.