International Journal of Cyber-Security and Digital Forensics

8

Authors: Yoshihiro Kita, Fumio Sugai, MiRang Park, Naonobu Okazaki

Recently, mobile terminals such as smartphones have come into widespread use. Most of such mobile terminals store several types of important data, such as personal information. Therefore, it is necessary to lock and unlock terminals using a personal authentication method such as personal identification numbers (PINs) in order to prevent data theft. However, most existing authentication methods have a common problem referred to here as “shoulder-surfing”, in which authentication information is covertly obtained by a person watching “over-the-shoulder” of a user as he/she completes the authentication sequence. In the present paper, a new icon-based authentication method that is simple but sufficiently secure even when the authentication sequence is being watched is proposed. The proposed method is implemented on a mobile data terminal and is evaluated through experiments and questionnaire surveys.

9

Authors: Shuhui Hou, Siu-Ming Yiuy, Tetsutaro Ueharaz, Ryoichi Sasakix

Capturing digital evidence is crucial for counteracting against computer and cyber crimes. The technique of cloning the whole harddisk (for single PC) for investigation is not feasible in large sharing systems (e.g. in a third-party email server, data center or cloud system). Privacy is also a major concern as most of the data in these systems is not relevant to the crime case. The problem is how to retrieve the relevant information without the investigator knowing, other irrelevant data while the server administrator does not know what the investigator is searching. To solve this problem, Hou et al. modelled the problem as a secure keyword searching problem and proposed a number of encryption-based schemes. While the schemes are theoretically sound, the efficiency is a concern. Besides, there are several shortcomings in their schemes. Data integrity and authenticity are not considered; re-encryption for each investigator is needed if there are multiple investigators. In this paper, we solve the same problem using the technique of secret sharing to improve efficiency. By exploiting the homomorphic property of the secret sharing schemes, data integrity and authenticity can be guaranteed using digital signature. Our solution can also handle multiple investigators more efficiently. We showed that our solution is more efficient by experiments and comparing the number of operations required by our solution with some existing work.

9

Authors: S. Kami Makki, Md. Sadekur Rahman

Information theft or data leakage is a growing concern for companies, as well as, individual users. Intruders can easily copy a huge amount of confidential data using hand-held devices such as USB flash drives, iPods, digital cameras or any other external storage devices. Data theft can simply occur through both insiders and outsiders of a corporation. It is becoming the biggest challenge for companies, since the storage devices are becoming smaller in size, easier to use, have higher capacity and data transmission speed. Furthermore, these devices can easily be misplaced or stolen and sensitive data can easily be exposed. In this paper we present a multilevel password verification system for prevention of information theft by removable devices to protect data leakage by various portable devices. Our proposed system consists of three main modules: 1) portable storage device monitoring, 2) activity logging and data encryption, and 3) device authorization. These modules cooperate with each other to provide required security, and prevent information theft from the individual users and companies.

11

Authors: Frances Bernadette C. De Ocampo, Trisha Mari L. Del Castillo, Miguel Alberto N. Gomez

Signature-based Intrusion Detection System (IDS) helps in maintaining the integrity of data in a network controlled environment. Unfortunately, this type of IDS depends on predetermined intrusion patterns that are manually created. If the signature database of the Signature-based IDS is not updated, network attacks just pass through this type of IDS without being noticed. To avoid this, an Anomaly-based IDS is used in order to countercheck if a network traffic that is not detected by Signature-based IDS is a true malicious traffic or not. In doing so, the Anomaly-based IDS might come up with several numbers of logs containing numerous network attacks which could possibly be a false positive. This is the reason why the Anomaly-based IDS is not perfect, it would readily alarm the system that a network traffic is an attack just because it is not on its baseline. In order to resolve the problem between these two IDSs, the goal is to correlate data between the logs of the Anomaly-based IDS and the packet that has been captured in order to determine if a network traffic is really malicious or not. With the supervision of a security expert, the malicious network traffic would be verified as malicious. Using machine learning, the researchers can identify which algorithm is better than the other algorithms in classifying if a certain network traffic is really malicious. Upon doing so, the creation of signatures would follow by basing the automated creation of signatures from the detected malicious traffic.

11

Authors: Mohammad Rasool Sarrafi Aghdam, Noboru Sonehara

K-anonymity is the model that is widely used to protect the privacy of individuals in publishing micro-data. It could be defined as clustering with constrain of minimum k tuples in each group. K-anonymity cuts down the linking confidence between sensitive information and specific individual by the ration of 1/k. However, the accuracy of the data in k-anonymous dataset decreases due to information loss. Moreover, most of the current approaches are for numerical attributes or in case of categorical attributes they require extra information such as attribute hierarchical taxonomies which often do not exist. In this paper we propose a new model, based on clustering, defining the distance between tuples including numerical and categorical attributes which does not require extra information and present the SpatialDistance (SD) heuristic algorithm. Comparisons of experimental results on real datasets between SD algorithm and existing well-known algorithms show that SD performs the best and offers much higher data utility and reduces the information loss significantly.

12

Authors: Ralph Edem Agbefu, Yoshiaki Hori, Kouichi Sakurai

Malicious web pages that host drive by download exploits have become a popular means by which an attacker delivers malicious contents to computers across the internet. The popularity of the attack has led to researchers developing systems to detect and stop such attacks. These methods include dynamic solutions, static solutions and the use of blacklisting and whitelisting methods. Blacklisting and in particular URL blacklisting is one of such detection methods. URL blacklisting analyzes the structure of a web page URL. URL blacklisting are however prone to evasion attacks when the lexical structure of the URL changes. In this paper, we propose the usage of domain related information for the detection of drive by download web pages. These domain features are used to model a scoring mechanism classification system. We show the effectiveness of detecting malicious web pages using domain based by obtaining a high detection rate and a relatively low false negative.

14

Authors: Cheng Qu, Yinyan Yu, Zhi Tang, Xiaoyu Cui

A digital file has both the content and physical information, however the latter was not fully made use of in previous digital rights management (DRM) systems. This paper introduces the idea of making use of file physical information to improve the system security and provides a scheme based on this idea to resist the replay attack in DRM systems. In our scheme, compared to commonly used schemes, we remove the dependency on continuous online connection from the client-side to the server-side or the usage of tamper-proof hardware, such as Trusted Platform Module (TPM). The scheme is appropriate for offline digital content usage. Primary experiments demonstrate that our scheme is secure enough to be put into practice use.

16

Authors: Shuhui Hou, Siu-Ming Yiuy, Tetsutaro Ueharaz, Ryoichi Sasakix

Capturing digital evidence is crucial for counteracting against computer and cyber crimes. The technique of cloning the whole harddisk (for single PC) for investigation is not feasible in large sharing systems (e.g. in a third-party email server, data center or cloud system). Privacy is also a major concern as most of the data in these systems is not relevant to the crime case. The problem is how to retrieve the relevant information without the investigator knowing, other irrelevant data while the server administrator does not know what the investigator is searching. To solve this problem, Hou et al. modelled the problem as a secure keyword searching problem and proposed a number of encryption-based schemes. While the schemes are theoretically sound, the efficiency is a concern. Besides, there are several shortcomings in their schemes. Data integrity and authenticity are not considered; re-encryption for each investigator is needed if there are multiple investigators. In this paper, we solve the same problem using the technique of secret sharing to improve efficiency. By exploiting the homomorphic property of the secret sharing schemes, data integrity and authenticity can be guaranteed using digital signature. Our solution can also handle multiple investigators more efficiently. We showed that our solution is more efficient by experiments and comparing the number of operations required by our solution with some existing work.

18

Authors: Farid Daryabar, Ali Dehghantanha, Nur Izura Udzir, Nor Fazlida binti Mohd Sani, Solahuddin bin Shamsuddin

Nowadays, digital storage of computer data is moving toward cloud computing which is a set of infrastructure provides data storage for organizations and individuals. Due to this large scale, in case an attack occurs in the network of a cloud it would be a big challenge to investigate the cloud. Therefore, digital forensics in cloud computing is a new discipline related to the increasing use of computers, networks and digital storage devices in numerous criminal activities in both traditional and Hi-Tech. This study reviews the literature on some challenges in cloud computing forensic investigation, and it is followed by evaluation and analysis of all types of information on cloud computing and its impacts on computer forensic investigations in publishing alliances with the survey was carried out in the field.

29

Authors: Farhood Norouzizadeh Dezfoli, Ali Dehghantanha, Ramlan Mahmoud, Nor Fazlida Binti Mohd Sani, Farid Daryabar

Nowadays, rapid evolution of computers and mobile phones has caused these devices to be used in criminal activities. Providing appropriate and sufficient security measures is a difficult job due to complexity of devices which makes investigating crimes involving these devices even harder. Digital forensic is the procedure of investigating computer crimes in the cyber world. Many researches have been done in this area to help forensic investigation to resolve existing challenges. This paper attempts to look into trends of applications of digital forensics and security at hand in various aspects and provide some estimations about future research trends in this area.