Computational Forensics Research Articles

An approach to identification and forensic analysis of DNS attacks

Domain name resolution servers (DNS) perform a key function in establishing access to web pages. Because of their importance, they are constant targets for cyber-attacks, which aim to erase or replace some of their records, causing huge losses for users, companies and institutions worldwide. In Brazil, to prevent such attacks, a legal provision is established that criminally typifies the invasion of computer devices connected to the World Wide Web, which includes attacks on the DNS service. Still, cyber-attack identification is difficult as it depends on the correct application of means of protection, monitoring of network services and extraction and interpretation of data that allow the identification of criminal factors. The present work proposes a computational forensics approach to automatically detect the occurrence of a DNS cache poisoning attack, subsuming the elements that constitute the attack to the legal device, thus identifying the occurrence of a crime.

Experimental and Computational Forensics Characterization of Weapons-Grade Plutonium Produced in a Fast Reactor Neutron Environment

A terrorist attack using an improvised nuclear device is one of the most serious dangers facing the United States. The work presented here is part of an effort to improve nuclear deterrence by developing a methodology to attribute weapons-grade plutonium to a source reactor by measuring the intrinsic physical characteristics of the interdicted plutonium. In order to demonstrate the developed methodology, plutonium samples were produced from depleted uranium dioxide (DUO2) surrogates irradiated in a fast-neutron environment. In order to replicate the neutron flux in a fast-neutron-spectrum reactor and obtain experimental samples emulating weapons-grade plutonium produced in the blanket of a fast breeder reactor, DUO2 samples were placed in a gadolinium sheath and irradiated in the High Flux Isotope Reactor (HFIR) at Oak Ridge National Laboratory. Previous computational work on this topic identified several fission products that could be used to distinguish between reactor types (fast and thermal reactors), specifically: 137Cs, 134Cs, 154Eu, 125Sb, 144Ce, 85Rb, 147Pm, and 150Sm along with the plutonium isotopes. Simulations of the fast neutron irradiation of the DUO2 fuel surrogates in the HFIR were carried out using the Monte Carlo radiation transport code MCNPX 2.7. Comparisons of the predicted values of plutonium and fission product concentrations to destructive and nondestructive assay measurements of neutron-irradiated DUO2 surrogates are presented here. The agreement between the predictions and gamma spectroscopic measurements in general were within 10% for 134Cs, 137Cs, 154Eu, and 144Ce. Additional experimental results (mass spectroscopy) agreed to within 5% for the following isotopes: 85Rb, 147Pm, 150Sm, 154Eu, 148Nd, 144Ce, and 239Pu. Two indicator isotopes previously suggested to differentiate between the reactor types were ruled out for use in the attribution methodology; 125Sb was ruled out due to the difficulty in accurately predicting its concentration, and 242Pu was ruled out because of its low content in weapons-grade plutonium.

Forensic Expertise in Storage Device USB Flash Drive: Procedures and Techniques for Evidence

This research aims to describe the phases and the proper procedures for recovering storage device data, analyzing the computational forensics tools: Autopsy Forensic Browser and Foremost, used for information retrieval, review the evidence and give it probative value before a jury. Check which of the tools used is the best performer, stressing the runtime and the performance of these tools.

Efficient height measurements in single images based on the detection of vanishing points

Surveillance cameras have become a customary security equipment in buildings and streets worldwide. It is up to the field of Computational Forensics to provide automated methods for extracting and analyzing relevant image data captured by such equipment. In this article, we describe an effective and semi-automated method for detecting vanishing points, with their subsequent application to the problem of computing heights in single images. With no necessary camera calibration, our method iteratively clusters segments in the bi-dimensional projective space, identifying all vanishing points – finite and infinite – in an image. We conduct experiments on images of man-made environments to evaluate the output of the proposed method and we also consider its application on a photogrammetry framework.

Forensics Tracking for IP User using the Markov Chain Model

Increasingly severe cybercrime results in heavy impact and loss for society and public security of various countries, and even influences Homeland security. Based on previous experiences, the most effective method to resist cybercrime and reduce its impact and damage is that law enforcement agencies (LEA) identify and arrest criminals within the shortest time possible after a crime occurs. Therefore, IP and IP Individualization play key roles. In view of this, this study proposes an IP user tracking forensics mechanism, based on the concepts of IP and computational forensics, to develop forensics tracking on the Internet. The proposed mechanism can instantly trace the location of cybercriminals when cybercrimes occurs, analyze the probable associatively, and reconstruct the historical physical path of the cybercriminal. The proposed mechanism was implemented for verification. The results showed that the accuracy of IP is 0 m error on the fixed network, while the mobile network could reach Cell-ID covered range (150-500 m radius in urban area). The identity of cybercriminal could be successfully reasoned out, with segmental paths (e.g. tracking breakpoints) reconstructed by algorith m, thus, obtaining the complete path of the target. The average success ratio (predictable ratio) was 90.91%, and the accuracy rate was 88.70%.

Evidentiary Power and Propriety of Digital Identifiers and the Impact on Privacy Rights in the United States

Media and network systems capture and store data about electronic activity in new, sometimes unprecedented ways; computational systems make for new means of analysis and knowledge development. These new forms offer new, powerful tactical tools for investigations of electronic malfeasance under traditional legal regulation of state power, particular that of Fourth Amendment limitations on police searches and seizures under the U.S. Constitution. But autonomy, identity and authenticity concerns with electronic data raise issues of public policy, privacy and proper police oversight of civil society. We examine those issues and their implications for digital and computational forensics

Data mining and crime analysis

AbstractAn essential component of criminal investigation involves the interrogation of large databases of information held by police and other criminal justice agencies. Data mining and decision support systems have an important role to play in assisting human inference in this forensic domain that creates one of the most challenging decision‐making environments. Technologies range widely and include social network analysis, geographical information systems, and data mining technologies for clustering crimes, finding links between crime and profiling offenders, identifying criminal networks, matching crimes, generating suspects, and predicting criminal activity. This paper does not intend to cover the gamut of techniques available to the investigator of crime as this has been presented elsewhere (Oatley GC, Ewart BW, Zeleznikow J. Decision support systems for police: lessons from the application of data mining techniques to ‘soft’ forensic evidence. Artif Intell Law 2006, 14:35–100). Rather, the objective is to highlight issues of implementation and interpretation of the techniques available to the crime analyst. To this end, the authors draw from their experiences of working with real‐world crime databases (Oatley GC, Belem B, Fernandes K, Hoggarth E, Holland B, Lewis C, Meier P, Morgan K, Santhanam J, et al. The gang gun‐crime problem—solutions from social network theory, epidemiology, cellular automata, Bayesian networks and spatial statistics. Accepted: book chapter for IEEE publication Computational Forensics; 2008; Oatley GC, McGarry K, Ewart BW. Offender network metrics. WSEAS Trans Inf Sci Appl 2006, 3:2440–2448; Oatley GC, Ewart BW. Crimes analysis software: pins in maps, clustering and Bayes net prediction. Expert Syst Appl 2003, 25:569–588), involving gun and gang crime, fraud, terrorism, burglary, and retail crime. © 2011 John Wiley & Sons, Inc. WIREs Data Mining Knowl Discov 2011 1 147‐153 DOI: 10.1002/widm.6This article is categorized under: Algorithmic Development > Spatial and Temporal Data Mining Application Areas > Science and Technology Application Areas > Society and Culture Fundamental Concepts of Data and Knowledge > Human Centricity and User Interaction

Computing the scene of a crime

The paper presents computational forensics method that can reduce the bias inherent in traditional criminal forensics.