2015 Ninth International Conference on IT Security Incident Management & IT Forensics最新文献

Supporting Forensic Design - A Course Profile to Teach Forensics 辅助法医学设计——法医学教学课程简介

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.16

Stefan Kiltz, J. Dittmann, C. Vielhauer

{"title":"Supporting Forensic Design - A Course Profile to Teach Forensics","authors":"Stefan Kiltz, J. Dittmann, C. Vielhauer","doi":"10.1109/IMF.2015.16","DOIUrl":"https://doi.org/10.1109/IMF.2015.16","url":null,"abstract":"There is a growing demand for experts with a dedicated knowledge of forensics, especially in the domain of digital and digitised forensics, besides a general shortage of teaching of digital forensics. Further, there is prominent lack of standardisation in designing a curriculum [18]. We address this by offering the profile ForensikDesign@Informatik [23] to the bachelor's degree at university level. By teaching digital and digitised forensics, we propose a model-based approach combining the practitioners and the computer scientist's view [19], also to address the standardisation issue. We identify three main application areas: teaching conventional digital forensic examinations using existing tools and methods following the model-based approach, the design of new forensic tools and methods and the system design to achieve a desired degree of forensic readiness in the conflict field of a degree of anonymity. The last two application areas, we believe, also justify teaching at university level. We set an international focus, and highlight the science part of forensic sciences. Selected law aspects are addressed both for motivational and comparative purposes. We implement different teaching strategies and provide dedicated resources (technical, organisational and personnel). Finally, we outline the two options for the profile ForensikDesign@Informatik, depending on the effort of commitment by the students.","PeriodicalId":132870,"journal":{"name":"2015 Ninth International Conference on IT Security Incident Management & IT Forensics","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121538406","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 13

Windows NT pagefile.sys Virtual Memory Analysis Windows NT页面文件。sys虚拟内存分析

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.10

M. Gruhn

引用次数: 7

Recovery of SQLite Data Using Expired Indexes 使用过期索引恢复SQLite数据

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.11

Felix Ramisch, Martin Rieger

引用次数: 7

Latent Fingerprint Aging from a Hyperspectral Perspective: First Qualitative Degradation Studies Using UV/VIS Spectroscopy 高光谱视角下的潜在指纹老化:首次使用紫外/可见光谱进行定性降解研究

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.18

R. Merkel

{"title":"Latent Fingerprint Aging from a Hyperspectral Perspective: First Qualitative Degradation Studies Using UV/VIS Spectroscopy","authors":"R. Merkel","doi":"10.1109/IMF.2015.18","DOIUrl":"https://doi.org/10.1109/IMF.2015.18","url":null,"abstract":"Latent print age estimation is an important topic in the emerging field of digitized crime scene forensics. While several capturing devices have recently been studied towards this goal, hyperspectral imaging in the UV/VIS (ultraviolet and visible light) range of the electromagnetic spectrum has not been investigated so far. Addressing this research gap, a first qualitative evaluation on the aging behavior of 30 latent print time series from 6 different donors is conducted, utilizing an optical reflection spectrometer. Results show more unpredictable aging tendencies in the ultraviolet spectral range, whereas a general logarithmic trend from prior work (using non-spectral capturing devices) is confirmed for the visible light band. Furthermore, a different behavior of eccrine and sebaceous print components is found, especially in the ultraviolet band, where sebaceous components seem to become reflective to the emitted radiation and might furthermore be utilized for studying longer aging periods in contrast to eccrine prints. Overall, the combined degradation information of the ultraviolet and the visible light band seem to provide the most reliable results for measuring a reproducible aging trend, serving as a potential opportunity to address the strong influence of different sweat compositions on the aging behavior of latent prints.","PeriodicalId":132870,"journal":{"name":"2015 Ninth International Conference on IT Security Incident Management & IT Forensics","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129659412","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack? 迈向自动化事件处理:如何选择适当的响应来对抗基于网络的攻击?

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.13

Sven Ossenbuhl, Jessica Steinberger, Harald Baier

{"title":"Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack?","authors":"Sven Ossenbuhl, Jessica Steinberger, Harald Baier","doi":"10.1109/IMF.2015.13","DOIUrl":"https://doi.org/10.1109/IMF.2015.13","url":null,"abstract":"The increasing amount of network-based attacks evolved to one of the top concerns responsible for network infrastructure and service outages. In order to counteract these threats, computer networks are monitored to detect malicious traffic and initiate suitable reactions. However, initiating a suitable reaction is a process of selecting an appropriate response related to the identified network-based attack. The process of selecting a response requires to take into account the economics of an reaction e.g., risks and benefits. The literature describes several response selection models, but they are not widely adopted. In addition, these models and their evaluation are often not reproducible due to closed testing data. In this paper, we introduce a new response selection model, called REASSESS, that allows to mitigate network-based attacks by incorporating an intuitive response selection process that evaluates negative and positive impacts associated with each countermeasure. We compare REASSESS with the response selection models of IE-IRS, ADEPTS, CS-IRS, and TVA and show that REASSESS is able to select the most appropriate response to an attack in consideration of the positive and negative impacts and thus reduces the effects caused by an network-based attack. Further, we show that REASSESS is aligned to the NIST incident life cycle. We expect REASSESS to help organizations to select the most appropriate response measure against a detected network-based attack, and hence contribute to mitigate them.","PeriodicalId":132870,"journal":{"name":"2015 Ninth International Conference on IT Security Incident Management & IT Forensics","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131986147","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 24

Conception of a Master Course for IT and Media Forensics Part II: Android Forensics IT和媒体取证硕士课程的概念第二部分:Android取证

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.19

K. Bellin, R. Creutzburg

引用次数: 2

Smart Home Definition and Security Threats 智能家居定义和安全威胁

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.17

M. Schiefer

引用次数: 72

Improving the Detection of Encrypted Data on Storage Devices 提高对存储设备上加密数据的检测能力

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.12

S. Thurner, M. Grun, S. Schmitt, Harald Baier

{"title":"Improving the Detection of Encrypted Data on Storage Devices","authors":"S. Thurner, M. Grun, S. Schmitt, Harald Baier","doi":"10.1109/IMF.2015.12","DOIUrl":"https://doi.org/10.1109/IMF.2015.12","url":null,"abstract":"The detection of persistently stored encrypted data plays an increasingly important role in digital forensics. This is especially true during live analysis of IT systems, when the encrypted data structures are temporarily decrypted in main memory and thus can be accessed as plaintext. One method commonly used to detect the presence of encrypted data on a storage device is the calculation of entropy. However, this method has a significant drawback: both random and compressed data have a very similar entropy compared to encrypted data, which yields a high false positive rate. That is why entropy is not very suitable to differentiate between these types of data.In this work we suggest both a workflow for detection of encrypted data structures on a storage device and an improved classification algorithm. The classification part of the workflow is based on statistical tests. For convenience of the investigator an important goal is to minimize the number of falsely classified unencrypted data structures (e.g. compressed data is classified as encrypted data). Our approach to achieve this goal is to combine different statistical tests. As a practical proof of concept we provide and evaluate a tool for automated analysis of storage devices that implements a multitude of statistical tests for improved detection of encrypted data, compared to both the application of only one such test and the calculation of entropy. More precisely our tool is able to reliably distinguish high-entropy file formats (i.e. DOCX, JPG, PDF, ZIP) from encrypted files (i.e. a truecrypt container).","PeriodicalId":132870,"journal":{"name":"2015 Ninth International Conference on IT Security Incident Management & IT Forensics","volume":"2004 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116051233","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

Platform Independent Malware Analysis Framework 平台独立的恶意软件分析框架

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.21

Ulf Losche, Maik Morgenstern, H. Pilz

引用次数: 1

Mobile Payment Fraud: A Practical View on the Technical Architecture and Starting Points for Forensic Analysis of New Attack Scenarios 移动支付诈骗:新攻击场景取证分析技术架构与起点的实用视角

2015 Ninth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2015-05-18 DOI: 10.1109/IMF.2015.14

Christof Kier, G. Madlmayr, Alexander Nawratil, Michael Schafferer, Christian Schanes, T. Grechenig

{"title":"Mobile Payment Fraud: A Practical View on the Technical Architecture and Starting Points for Forensic Analysis of New Attack Scenarios","authors":"Christof Kier, G. Madlmayr, Alexander Nawratil, Michael Schafferer, Christian Schanes, T. Grechenig","doi":"10.1109/IMF.2015.14","DOIUrl":"https://doi.org/10.1109/IMF.2015.14","url":null,"abstract":"As payment cards and mobile devices are equipped with Near Field Communication (NFC) technology, electronic payment transactions at physical Point of Sale (POS) environments are changing. Payment transactions do not require the customerto insert their card into a slot of the payment terminal. The customer is able to simply swipe the payment card or mobilephone in front of a dedicated zone of the terminal to initiate a payment transaction. Secure Elements (SEs) in mobile phonesand payment cards with NFC should keep sensitive application data in a save place to protect it from abuse by attackers.Although hardware and the operating system of such a chip has to go through an intensive process of security testing, thecurrent integration of such a chip in mobile phones easily allows attackers to access the information stored. In the followingpaper we present the implementation of two different proof-of-concept attacks. Out of the analysis of the attack scenarios, wepropose various starting points for the forensic analysis in order to detect such fraudulent transactions. The presented conceptshould lead to fewer fraudulent transactions as well as protected evidence in case of fraud.","PeriodicalId":132870,"journal":{"name":"2015 Ninth International Conference on IT Security Incident Management & IT Forensics","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124685778","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3