2016 4th International Symposium on Digital Forensic and Security (ISDFS)最新文献_第2页

A design review: Concepts for mitigating SQL injection attacks 设计回顾:减轻SQL注入攻击的概念

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473537

Ed Pearson, Cindy L. Bethel

{"title":"A design review: Concepts for mitigating SQL injection attacks","authors":"Ed Pearson, Cindy L. Bethel","doi":"10.1109/ISDFS.2016.7473537","DOIUrl":"https://doi.org/10.1109/ISDFS.2016.7473537","url":null,"abstract":"Recently, it is not unusual to notice media coverage of some major breach in some large organization's cyber security. A large number of said breaches are due to vulnerabilities in their software or system. Once an in-depth analysis of these vulnerabilities was performed, it came to light that a large number of these vulnerabilities were the result of development issues. To be more specific, either the developers or the design process was the cause of the vulnerabilities. A particular vulnerability initiated by developers or a subpar design process is injection attacks. In particular SQL injection attacks (SQLIA) have been the culprit of most organizational cyber security breaches. This form of attack could have a detrimental impact on a business or organization. These impacts could range from monetary loss, exposure of confidential business information, exposure of customer data, a decrease in company stock value, or some combination of these four. SQL injection attacks are relatively common in interactive web applications. Not only are SQL injection attacks common they are easily detectable and are reasonably simple to mitigate. There is a plethora of literature on defending against SQL injection attacks once a system or software is functional. The goal of this work is to address the issue of SQL injection attacks starting in the design process. The contribution of this paper is a proposed design review methodology that allows designers to examine the user interface (UI) and user experience (UX) in the design phase to expose any attack surfaces that allow for an injection attack to occur. In particular, the method proposed in this work combines human computer interaction concepts along with cyber security principles and software security techniques to design a user interface that is not subject to SQL injection attacks. Because injection attacks occur from malicious user input, this method concentrates on the design of the interface to eliminate all entry points that allow for injection attacks.","PeriodicalId":136977,"journal":{"name":"2016 4th International Symposium on Digital Forensic and Security (ISDFS)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116228155","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

The role of digital forensics in combating cybercrimes 数字取证在打击网络犯罪中的作用

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473532

Malek Harbawi, A. Varol

引用次数: 19

A review on mobile threats and machine learning based detection approaches 移动威胁和基于机器学习的检测方法综述

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473509

Bilgehan Arslan, S. Gunduz, Ş. Sağiroğlu

引用次数: 19

Multibiometrics approach on biometric passport pictures by using fingerprint minutiae points 基于指纹特征点的护照生物识别图像多生物识别方法

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473524

Sercan Aygün, M. Akçay

{"title":"Multibiometrics approach on biometric passport pictures by using fingerprint minutiae points","authors":"Sercan Aygün, M. Akçay","doi":"10.1109/ISDFS.2016.7473524","DOIUrl":"https://doi.org/10.1109/ISDFS.2016.7473524","url":null,"abstract":"Biometrics has its own popularity in recent years especially in engineering field. Biometrics related researches have been increasingly handled by scientists to achieve more secure and high performed systems. In low level or higher level designs, there are two basic criterion initially to be considered: area and speed. Hardware designs like in smart cards require less complex circuits in the sense of area. In this study, there will be system related biometric research and implementations by only considering the high level designs. Module based high level design is implemented which includes feature extraction and decision modules. In the first, biometric feature extraction together with relatively new techniques is handled. Fingerprint identification and face recognition are the first part interests by using new operators to reduce the operation complexity. In the second module, the decision of the authentication will be handled by using multi biometrics. Fingerprint and face are popular biometrics. In the feature extraction phase, new method to obtain features is used both for the finger and for the face. New image processing operator, Relational Bit Operator (RBO) is for the face biometry. Besides, Angle Invariant Fingerprint Features Matching Technique (AIFM) is for fingerprint matching. This paper presents the introduction to biometric systems together with literature review. After the design issues are presented, the test results related to biometric authentication metric is added in the final draw of the paper.","PeriodicalId":136977,"journal":{"name":"2016 4th International Symposium on Digital Forensic and Security (ISDFS)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123321433","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Toward a new tool to extract the evidence from a memory card of mobile phones 开发一种新的工具从手机的存储卡中提取证据

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473533

R. Witteman, A. Meijer, Mohand Tahar Kechadi, Nhien-An Le-Khac

{"title":"Toward a new tool to extract the evidence from a memory card of mobile phones","authors":"R. Witteman, A. Meijer, Mohand Tahar Kechadi, Nhien-An Le-Khac","doi":"10.1109/ISDFS.2016.7473533","DOIUrl":"https://doi.org/10.1109/ISDFS.2016.7473533","url":null,"abstract":"Today, a mobile phone is not just a \"phone\" but it is a computer that you can also use for calling someone. Besides, in criminal investigations the importance of evidence from the mobile phone is increasing as more and more phones are seized at the Digital Forensic Department of the police. Indeed, the amount of memory cards of these mobile phones that need to be investigated separately is also increasing. Possible reasons are that the mobile phone investigation software does not support the specific mobile phone or the specific, for that investigation, artefacts. Sometimes the software investigates just the internal memory of the mobile phone and not the data which is written on the memory card. Fact is also that although the mobile phone was investigated by the dedicated software, the possibility that the associated memory card contains additional important information is evident. The current procedure to get all of the usable information from a memory card of a mobile phone is very time-consuming process and not user friendly. In this paper, we present a new single tool to simplify the investigation of a memory card from a mobile phone. We also test our tool with WhatsApp application installed on the memory card from different mobile phones.","PeriodicalId":136977,"journal":{"name":"2016 4th International Symposium on Digital Forensic and Security (ISDFS)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131270059","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Client-initiated HTTP covert channels using relays 使用中继的客户端发起的HTTP隐蔽通道

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473513

Gregory Daneault, Daryl Johnson

引用次数: 2

Detecting unprotected SIP-based voice over IP traffic 检测未受保护的基于sip的IP语音流量

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473515

Leonardo Carvajal, Lei Chen, C. Varol, D. Rawat

{"title":"Detecting unprotected SIP-based voice over IP traffic","authors":"Leonardo Carvajal, Lei Chen, C. Varol, D. Rawat","doi":"10.1109/ISDFS.2016.7473515","DOIUrl":"https://doi.org/10.1109/ISDFS.2016.7473515","url":null,"abstract":"The use of Voice over IP (VoIP) applications has dramatically increased in recent years. Large, medium, and small organizations, as well as individuals, are reducing the cost of their phone calls using their data infrastructure or a broadband Internet service to transmit phone calls over IP networks. Like data networks, VoIP networks are also vulnerable to security threats such as Denial-of-Service (DoS) attacks, interception of private communications, registration hijacking, spam, and message tampering. Security mechanisms, such as encryption and authentication, may be used to reduce the potential impact of some of these security threats. However, in reality, VoIP providers may not supply adequate security, or otherwise they are adopting and implementing these countermeasures at very slow rates without informing users whether their phone calls are protected. Given the fact that the interception of private communications is one of the most commonly seen attacks in VoIP, we present a solution to detect unprotected SIP-based VoIP packets. Upon positive detection, alerts may be sent to users informing them about the unprotected VoIP calls, thus potentially preventing identity theft and improving security awareness. Our testing results show that our solution provides accurate detection with zero false detection rate of unprotected SIP-based VoIP traffic.","PeriodicalId":136977,"journal":{"name":"2016 4th International Symposium on Digital Forensic and Security (ISDFS)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-04-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116956872","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Mobil cihaz kullanıcı davranışlarının modellenmesi için yeni bir yaklaşım

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473539

Duygu Sinanc Terzi, Şeref Sağıroğlu

引用次数: 0

Integrating ethics and risk management 整合道德和风险管理

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473522

S. Lincke

引用次数: 0

A reputation based trust center model for cyber security 基于声誉的网络安全信任中心模型

2016 4th International Symposium on Digital Forensic and Security (ISDFS) Pub Date : 2016-04-25 DOI: 10.1109/ISDFS.2016.7473508

H. Kilinç, Ugur Cagal

引用次数: 3