Cybercrime Investigation Research Articles

Research Areas in Cyber Security and Forensic and Centre of Excellence for Forensic Laboratory

This research work identifies the national and international related work to identify the cutting-edge areas of research problems in the domain of cloud computing , mobile software and multimedia data for its security and cyber forensics. The explanatory research identifies the statement of problems with its aim, objectives, and the scope of the work to be conducted into the proposed cyber forensic laboratory. The hardware and software requirements for the cybercrime digital forensic laboratory are identified to conduct cybercrime research in the domain of cyber security for the recommendation of security. The Centre of excellence for computer cybercrime digital forensics will be useful for reading, writing, research, and development to give practical and feasible solutions for building digital forensic tools in the cutting domain of computing systems such as Cloud Computing, Web Applications, Mobile communication, and Multimedia Systems. The hardware and software requirements for setting up the forensic laboratory are identified and the budget expected to set the centre of excellence for a cybercrime investigation laboratory is approximately Rs.7,79,83,434.39/- which may vary depending on versions and updates to hardware and software’s.

Seizure in Cybercrime Investigations: Peculiarities of Production

This scientific article explores the peculiarities of seizure in the investigation of cybercrime. The authors consider the issues related to the need to involve information security specialists in this procedure. Special attention is paid to the issues of copying information from electronic media and protection of digital evidence. The article also analyzes cases when copying information may be prohibited in order to preserve data integrity and ensure law enforcement. The amendments to criminal procedure legislation proposed in the conclusions may be useful for improving the efficiency of cybercrime investigation and observing the legitimate rights and interests of all participants in criminal proceedings. В данной научной статье исследуются особенности производства выемки при расследовании киберпреступлений. Авторы рассматривают вопросы, связанные с необходимостью привлечения специалистов в области информационной безопасности при проведении данной процедуры. Особое внимание уделяется вопросам копирования информации с электронных носителей и защите цифровых доказательств. Статья также анализирует случаи, когда копирование информации может быть запрещено в целях сохранения целостности данных и обеспечения правопорядка. Предлагаемые в выводах изменения в уголовно-процессуальное законодательство могут быть полезными для улучшения эффективности расследования киберпреступлений и соблюдения законных прав и интересов всех участников уголовного процесса. Бұл ғылыми мақалада киберқылмыстарды тергеу кезінде қазба өндірісінің ерекшеліктері зерттелген. Авторлар осы процедураны жүргізу кезінде ақпараттық қауіпсіздік саласындағы мамандарды тарту қажеттілігіне байланысты мәселелерді қарастырады. Электрондық тасымалдағыштардан ақпаратты көшіру және цифрлық дәлелдемелерді қорғау мәселелеріне ерекше назар аударылады. Мақала сонымен қатар деректердің тұтастығын сақтау және құқықтық тәртіпті қамтамасыз ету мақсатында ақпаратты көшіруге тыйым салынуы мүмкін жағдайларды талдайды. Қорытындыларда ұсынылған қылмыстық іс жүргізу заңнамасына енгізілген өзгерістер киберқылмыстарды тергеудің тиімділігін жақсарту және қылмыстық процеске қатысушылардың барлығының заңды құқықтары мен мүдделерін сақтау үшін пайдалы болуы мүмкін. Түйінді сөздер: тәркілеу, тергеу әрекеті, қылмыстық іс жүргізу, тергеу, киберқылмыс, интернет ұрлау.

Role of Digital Forensics in Combating Financial Crimes in the Computer Era

Abstract Information and communication technologies (ICT) have changed every area of our lives. Cyberspace-related areas have reflected these shifts. Cyberspace has an undeniable positive impact on information, trade, industry, and communication. On the other hand, cybercrime is a dark side of the Internet that degrades its peaceful use. Any illegal activity carried out by or via cyberspace and its electronic environment is characterized as cybercrime. Unlike traditional crimes, cybercrimes present a real dilemma because the identities of criminals may be hidden in the virtual domain. Digital forensics has emerged to formulate possible ways for cybercrime investigation and analysis process. In this paper, we deplore the idea of digital forensics in the context of cybercrimes. An investigation of the positive impact of digital forensics in combating cybercrimes is discussed. In today’s world of computers, any information can be made available within a few clicks for different endeavors. The information may be tampered with by changing the statistical properties and can be further used for criminal activities.

We're making a list and we're checking it twice, gonna find out what makes digital forensic examiners suffice

AbstractDigital forensic examinations have grown in breadth and depth at a currently unsustainable rate. Digital Investigations now feature in around 90% of criminal cases, demonstrating that digital evidence is crucial to forensic investigations. Due to the high number of cases, most law enforcement units have significant backlogs of devices waiting for analysis. As the field of Digital Investigation has grown, it is no longer solely related to criminal investigations, with the techniques also supporting civil, private, and corporate activities. Given the evident challenges, it is logical that more digital forensic experts are needed to keep pace with the field's complexities and demands. Identifying what characteristics and skills make a digital forensic expert enables an evaluation to ensure that any new staff are fit for purpose. There is a growth in academic, civil, corporate, and intelligence‐based activity within the field. Each area defines their standards, field scope, and expertise level. Still, as any case has the potential to become a matter of criminal investigation, surely the focus needs to be on the standards required to ensure evidence is admissible for that purpose. As expertise levels can vary, it is also necessary to challenge the level at which an expert is defined and the implications of this decision. By identifying what makes an expert in this unique forensic science area, it is possible to explore the potential challenges the field faces in obtaining, retaining, and training staff.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation

Investigation and Adjudication of Cybercrimes in India

Investigation and Adjudication of Cybercrimes in India

Cyber security threats in IoT: A review

The Internet of Things (IoT) is the most secure platform for making human existence easier and more comfortable. IoT has made a big contribution to a variety of software programs. The rapid proliferation of smart devices, as well as their trust in data transfer and the use of Wi-Fi mechanics, has increased their vulnerability to cyber-attacks. As a result, the cost of cybercrime is rising every day. As a result, investigating IoT security threats and possible countermeasures can assist researchers in creating acceptable ways to deal with a variety of stressful scenarios in cybercrime research. The IoT framework, as well as IoT architecture, protocols, and technology, are all covered in this assessment research. Various protection issues at each tier, as well as correction strategies, are also detailed. In addition, this article discusses the use of IoT forensics in cybercrime investigations in a variety of areas, including cybercrime research, Artificial intelligence, system learning, cloud computing, fog computing, and blockchain technology all play a role in this discussion. Finally, some open research on challenging situations in IoT is detailed to enhance cybercrime investigations, providing a cutting-edge course for future research.

Artificial Intelligence in Law Enforcement and Justice Bodies: Domestic and European Experience

The primary concerns of this research paper are to reveal current issues of the application of artificial intelligence technologies in law enforcement and justice bodies in the conditions of martial law and global threats; to identify the main trends, issues and forensic research prospects using artificial intelligence through the prism of European integration processes; to highlight gaps in the normative and legal regulation of the use of digital technologies; outline directions for its improvement. In order to reach objectives, general scientific and special methods (in particular, dialectical, analytical, induction and deduction, and others) were applied. The domestic and European experience in the application of artificial intelligence technologies in law enforcement and justice bodies was analyzed, and their promising directions were determined. We consider that legal regulation of the application of artificial intelligence in Ukraine should be carried out according to European standards, rules and recommendations in accordance with the European integration course chosen by our state. Note that introduction of the artificial intelligence into legal proceedings should be based preliminary on the principles of the rule of law, observance of basic human rights, respect for honor and dignity, equality before the law and the court, proportionality, competition between the parties, transparency, impartiality and justice. Artificial intelligence is not capable of completely replacing judges, however, its implementation will contribute to the optimization of the work of the judge and court. It is substantiated that in today’s military realities, the issue on increasing the effectiveness of the investigation of modern war crimes and cybercrimes with the help of digital technologies has become acute.

The Role of Computer Technologies in Structuring Evidence Gathering in Cybercrime Investigations: A Qualitative Analysis

In recent decades, law enforcement agencies have increasingly prioritized cybercrime investigations, as evinced by the growing adoption of specialized cybercrime units and personnel. A burgeoning literature has emerged which examines cybercrime units and investigators. Yet, little attention has been given to the role of computers in shaping these investigations. This study addresses this gap through an analysis of qualitative interviews with 47 cybercrime investigative personnel including sworn detectives, civilian analysts, and unit administrators. This analysis confirms and extends prior research by exploring challenges presented by computers to cybercrime investigations including issues surrounding anonymization, encryption, jurisdiction, caseloads, backlogs, data volume, eliciting data from electronic service providers, and the ever-changing technological landscape. Also considered are the advantages offered by such technologies for cybercrime investigations. Computer and network technologies facilitate undercover investigations, provide easy access to global networks and databases, and supply large quantities of evidence to help secure convictions. Finally, this study considers elements of cybercrime investigations not supplanted by computer databases, automation, or network systems. Directions for future research and policy implications are considered.

A model of decoy system based on dynamic attributes for cybercrime investigation

The object of research are decoys with dynamic attributes. This paper discusses the impact of decoys involving blockchain technologies on the state of information security of the organization and the process of researching cybercrime. This is important because most cybercrimes are detected after the attacker gains access to sensitive data. Through systematic analysis of the literature focused on assessing the capabilities of decoy and blockchain technologies, this work identifies the main advantages of decoys that utilize blockchain technology. To assess the effectiveness of attacker detection and cybercrime analysis, controlled experiments were conducted using a blockchain-based decoy system that we developed aimed at determining network performance. As part of the study reported here, a technique is proposed to detect cybercrime using decoys based on blockchain technology. This technique is based on the fact that the attributes of the system change dynamically. Such a technique has made it possible to obtain a system model that solves the task of detecting decoys by intruders. In addition, the developed scheme reduces the load in contrast to the conventional fixed solution. The results indicate that the response time of services is significantly reduced in the environment of decoys with dynamic attributes. For example, Nginx's response time in a static host is twice as high as dynamic, and an Apache dynamic server can still respond to an intruder's attack even if a static server fails. Therefore, the results reported in the article give grounds to assert the possibility of using the solution in the infrastructure of information systems at the public and private levels

Proxy Re-Encryption based approach for Digital Evidence Management in Cybercrime Investigation - A Review

Proxy Re-Encryption based approach for Digital Evidence Management in Cybercrime Investigation - A Review

Cybercriminal networks in the UK and Beyond: Network structure, criminal cooperation and external interactions

AbstractThis article examines the network structure, criminal cooperation, and external interactions of cybercriminal networks. Its contribution is empirical and inductive. The core of this study involved carrying out 10 case analyses on closed cybercrime investigations – all with financial motivations on the part of the offenders - in the UK and beyond. Each analysis involved investigator interview and access to unpublished law enforcement files. The comparison of these cases resulted in a wide range of findings on these cybercriminal networks, including: a common division between the scam/attack components and the money components; the presence of offline/local elements; a broad, and sometimes blurred, spectrum of cybercriminal behaviour and organisation. An overarching theme across the cases that we observe is that cybercriminal business models are relatively stable.

THE SEARCH WARRANT PROVISIONS OF THE CYBERCRIMES ACT AND THEIR RELATIONSHIP WITH THE CRIMINAL PROCEDURE ACT

The recently enacted Cybercrimes Act 19 of 2020 regulates the powers of the police and investigators to investigate cybercrimes. Chapter 4 of the Act provides for the powers of the police and others in respect of search, access or seizure in the investigation of cybercrimes and other offences committed by means of cybertechnology. The provisions of the Criminal Procedure Act 51 of 1977 will continue to operate in addition to the provisions of the Cybercrimes Act, to the extent that the Criminal Procedure Act is not inconsistent with the Cybercrimes Act. The search and seizure provisions of the Criminal Procedure Act are object-based, as they do not deal explicitly with the specialised procedures that are required to investigate cybercrimes or other offences that involve the use of digital devices. The Cybercrimes Act attempts to address this shortcoming. The coexistence of the search and seizure provisions in these two Acts may cause difficulties in the fight against crime. In addition to the validity requirements of search warrants, as set out in the Acts, additional intelligibility requirements for the validity of search warrants have been developed by the courts.

Cyber crime investigation and digital forensics

Cyber crime investigation and digital forensics

Enhancing Police Officers’ Cybercrime Investigation Skills Using a Checklist Tool

This paper addressed the current state of police officers’ capabilities, skills, and their readiness to deal with the developments of cybercrime. This study discussed definition of cybercrime, cybercrime categories as well as comparison between traditional criminal techniques and cybercrime. As the abilities and skills required for detectives to investigate cybercrime have been discussed. Additionally, literature review and related work, was addressed challenges role of the police in combating cybercrime and facing cybercrime policing. We proposed the main tool in the study which is “Checklist of essential skills for a cybercrime investigator”. Thus, to gain the ability to Identify technical and practical requirements in terms of skills, programs, and equipment to achieve effective and professional results in fight cybercrimes.

Cybercrime investigation model

With each passing day, individuals, organizations, and even governmental entities are confronted with an escalating incidence of cybercrimes. Faced with limited resources and the increasing complexity of cyberattacks, organizations often find themselves incapable of detecting and preventing such malicious actions and necessitating investigative efforts to mitigate their consequences. The primary objective of this study is the development of a comprehensive model for cybercrime investigation. In constructing this model, we have drawn upon related literature concerning cybercrimes and their investigation, alongside employing a spectrum of research methodologies, including analysis and synthesis, examination and generalization, deduction, and induction. Through an analysis of the investigative phases and the required for them information, we have formulated a cybercrime investigation model. Furthermore, we have field-tested this model in the context of an insider attack investigation. It is envisaged that the proposed model can serve as a foundational framework for the formulation of practical guidelines pertaining to the investigation of information security incidents, applicable both in governmental and commercial organizations.

Admissibility of Digital Evidence for Cyber Crime Investigation

Admissibility of Digital Evidence for Cyber Crime Investigation

Forensics: Cybercrime investigation analysis in social networks

Cybercrime has emerged as a specialized domain, leveraging online communication networks with advanced specifications to identify cybercriminals through the application of cyber laws. Extensive research is underway to establish pertinent legal methodologies aimed at preventing and controlling cybercriminal activities. Over the past decade, considerable attention has been devoted to the compelling topics of malware and phishing detection, given the substantial damage inflicted upon internet users. Phishing website recognition represents recognizing these sites as potent tools for exploiting personal information and facilitating malicious activities. This paper introduces an innovative automatic categorization system designed to classify both malware identities and phishing websites. The system achieves this through the integration of clustering solutions, incorporating various clustering algorithms within a cluster ensemble scheme.

Exploring Dark Web Crawlers: A Systematic Literature Review of Dark Web Crawlers and Their Implementation

Strong encryption algorithms and reliable anonymity routing have made cybercrime investigation more challenging. Hence, one option for law enforcement agencies (LEAs) is to search through unencrypted content on the Internet or anonymous communication networks (ACNs). The capability of automatically harvesting web content from web servers enables LEAs to collect and preserve data prone to serve as potential leads, clues, or evidence in an investigation. Although scientific studies have explored the field of web crawling soon after the inception of the web, few research studies have thoroughly scrutinised web crawling on the "dark web" or via ACNs such as I2P, IPFS, Freenet, and Tor. The current paper presents a systematic literature review (SLR) that examines the prevalence and characteristics of dark web crawlers. From a selection of 58 peer-reviewed articles mentioning crawling and the dark web, 34 remained after excluding irrelevant articles. The literature review showed that most dark web crawlers were programmed in Python, using either Selenium or Scrapy as the web scraping library. The knowledge gathered from the systematic literature review was used to develop a Tor-based web crawling model into an already existing software toolset customised for ACN-based investigations. Finally, the performance of the model was examined through a set of experiments. The results indicate that the developed crawler was successful in scraping web content from both clear and dark web pages, and scraping dark marketplaces on the Tor network. The scientific contribution of this paper entails novel knowledge concerning ACN-based web crawlers. Furthermore, it presents a model for crawling and scraping clear and dark websites for the purpose of digital investigations. The conclusions include practical implications of dark web content retrieval and archival, such as investigation clues and evidence, and the related future research topics.

The Importance of Research in Forensic Sciences and Digital Forensics in Contemporary Society

Dear readers and researchers, It is with great pleasure that, as a member of the Editorial Board of the International Journal of Forensic Sciences (IJFSC), I share with you some reflections on the significant importance of Forensic Sciences for society and for the elucidation of crimes, with a special emphasis on Digital Forensics in the context of cybercrime investigations.

The Role of Digital Forensic Experts in Cybercrime Investigations in Indonesia Based on The Scopus Research Index

The development of information technology, besides having a positive impact, has negative impacts, such as an increase in cybercrime. Several parties are involved in handling cybercrimes in Indonesia, including expert witnesses in digital forensics. It is hoped that cybercrimes can be uncovered through a digital forensic approach. Research related to cybercrime and Digital Forensics in Indonesia is experiencing increasing growth from 2010 to 2021. A very rapid increase was shown in 2017. Through bibliometric analysis, you can analyze expert witnesses in the field of digital forensics by region in Indonesia, such as Sumatera, Western Java, Central Java, and Eastern Java. An expert witness in digital forensics must have technical skills in operating digital forensic tools and analysis and academic skills in uncovering crimes. The results of this study are very useful for law enforcement officers or lawyers in determining expert witnesses in the field of digital forensics. List of digital forensic experts in Indonesia who have been tested from their scientific studies by conducting various paper publications. So, law enforcement can synergize with digital forensic experts to solve cybercrime. One of the roles of a digital forensic expert is as an expert witness in court. Through research, it is hoped that there will be an increase in awareness of digital forensic experts to conduct scientific publications so that it is easier to be recognized by law enforcement and academics for updating methods and techniques of cybercrime investigation