A Forensic Framework for Webmail Threat Detection Using Log Analysis

At first, forensics was restricted to studying data that was stored on a system's hard disk. However, as storage capacity and data encryption increased, applying conventional digital forensic procedures became more challenging. As a result, memory forensics techniques are developed, or are frequently referred to as live forensics, because the process is quicker and more sophisticated. Volatile memory forensics, often known as live forensics, are necessary for this condition. Live forensics has flaws, specifically that some programs can fail when the computer is in active VSM (virtual secure mode). This results in the retrievable evidence being lost. Therefore, determining the cause is essential. The software-based memory acquisition tools Autopsy, Isobuster, DumpIt, and Magnet RAM Capturer are just a few examples. According to the findings of the experiments, the tools that have crashed include DumpIt v1.3.2.20110401. A dynamic code analysis using WindBg as a tool was utilized to study the impact of VSM on the memory acquisition tool. This study's goal is to identify the instances of crashes in various forensic instruments, which will be highly useful for forensic experts performing investigations.

The email system is a globally distributed communication infrastructure service that involves multiple actors playing different roles to ensure end-to-end mail delivery. It is an indispensable method of communicating that is changing how people share data and information. As a result, it facilitates effective and efficient communication, especially in business, as well as convenience, accessibility, and replication. Today, email can send more than just text files; it can also send audio, video, photos, and other files with extensions. With email becoming ubiquitous in all aspects of our lives, enhancing its security, operating procedures, and forensic investigation has become essential. The purpose of this paper is to review some real email forensic incidents and the tools and techniques that have been proposed. A discussion of the major threats to email as well as techniques to mitigate them will also be provided. A comparison study was made of several techniques and analysis tools used in email forensics. In addition, this paper compares the available software tools for email forensics based on factors such as language interface, user interface, programming language, creation of image files, calculation of hash value, cost, and advantages.

An important part of our personal life is being able to share with others different stories. In a regular family gathering, when meeting friends, during coffee break at work, people share all kinds of stories and events that have happened to them or to others. In other words storytelling enables people to share and reflect on their own or other people’s life experience. When a person, due to injury or disease, looses or becomes limited in his/her ability to use language (for example because of aphasia) or has difficulties with recalling past events (for example because of Alzheimer disease) she or he also looses the ability to share stories, which can in turn lead to increased social isolation. A variety of assistive tools has been developed in order to improve the communication abilities of disabled persons. So far, most of the existing systems focus on supporting elementary communication needs such as the ability to tell very simple and short stories (words or sentences). Even creating such short stories may already require a lot of effort from a disabled person and/or caretaker. In this project we aim at developing a storytelling supporting system for individuals with (expressive) aphasia or other related communication disorder. The main research question that inspires this thesis is whether or not technology can help to break (reduce) the social isolation of people with aphasia and other kinds of communication disorder by supporting story collecting, building and expressing. At the first phase of the project we interviewed persons with aphasia, their partners and therapists. Our objective was to identify what technologies they use and what they see as barriers to technology adoption. Later on, several devices were built for capturing daily stories. Since most aphasics have right-sided paralysis attention was given on the ergonomics and form factor of the capturing devices. In the later stage for sharing stories email was chosen. However, current email programs are not suitable for aphasics. Therefore, to understand the suitability of email for aphasics, an email template was redesigned. This email template came along with an Augmentative and Alternative Communication (AAC) software. The application was tested with aphasics and therapists. However, we also observed that the AAC software requires an expensive license which would prevent widespread distribution. Next to our initial designs we also investigated how people with aphasia communicate over email. Aphasia Union Netherlands (AVN) has a web-based social networking program designed to enhance communication between aphasics and therapists. We investigated how aphasics utilize the program. Therefore we extracted server logs and also collected subjective responses through two questionnaires. We found several issues such as poor navigation within the interface and privacy issues that hinder long-term adoption of this tool. This phase also helped us to gain new design insights for our own email client: Amail. In the next design phase we designed a new email client for aphasics. The new email client simplifies the complexity of traditional email clients such as Outlook, Hotmail etc. Moreover, our client provides twofold language support to compose email messages. The client provides opportunity to select words from incoming email and also from a mini dictionary designed with the help of the speech therapist. Moreover, we have designed three word selection techniques to support people with aphasia who also suffer from right sided paralysis. Our usability evaluation results indicate that Amail is suitable for some aphasics. Moreover, aphasics find the word selection techniques and the language support very useful. As a final evaluation of Amail we conducted a 3-month long field trial with eight aphasic individuals. Subjective data (questionnaires,interviews, and diaries) and objective data (usage logs) were collected to gain understanding of the usage patterns. Our findings suggest that aphasics were able to independently teach themselves the tool for emailing. The usage patterns, especially the frequency and length of the composed email messages, indicate that, over time, aphasics were able to conduct adequate e-mail communication. Aphasics email partners also showed increased confidence that their aphasic email partners were improving gradually. Last but not least, use of Amail has positively influenced the social contacts of aphasia participants.

Because of the recent exponential rise in attack frequency and sophistication, the proliferation of smart things has created significant cybersecurity challenges. Even though the tremendous changes cloud computing has brought to the business world, its centralization makes it challenging to use distributed services like security systems. Valuable data breaches might occur due to the high volume of data that moves between businesses and cloud service suppliers, both accidental and malicious. The malicious insider becomes a crucial threat to the organization since they have more access and opportunity to produce significant damage. Unlike outsiders, insiders possess privileged and proper access to information and resources. In this work, a machine learning-based system for insider threat detection and classification is proposed and developed a systematic approach to identify various anomalous occurrences that may point to anomalies and security problems associated with privilege escalation. By combining many models, ensemble learning enhances machine learning outcomes and enables greater prediction performance. Multiple studies have been presented regarding detecting irregularities and vulnerabilities in network systems to find security flaws or threats involving privilege escalation. But these studies lack the proper identification of the attacks. This study proposes and evaluates ensembles of Machine learning (ML) techniques in this context. This paper implements machine learning algorithms for the classification of insider attacks. A customized dataset from multiple files of the CERT dataset is used. Four machine learning algorithms, i.e., Random Forest (RF), Adaboost, XGBoost, and LightGBM, are applied to that dataset and analyzed results. Overall, LightGBM performed best. However, some other algorithms, such as RF or AdaBoost, may perform better on some internal attacks (Behavioral Biometrics attacks) or other internal attacks. Therefore, there is room for incorporating more than one machine learning algorithm to obtain a stronger classification in multiple internal attacks. Among the proposed algorithms, the LightGBM algorithm provides the highest accuracy of 97%; the other accuracy values are RF at 86%, AdaBoost at 88%, and XGBoost at 88.27%.

Attacks on cloud-computing services are becoming more prevalent with recent victims including Tesla, Aviva Insurance and SIM-card manufacturer Gemalto[1]. The risk posed to organisations from malicious insiders is becoming more widely known about and consequently many are now investing in hardware, software and new processes to try to detect these attacks. As for all types of attack vector, there will always be those which are not known about and those which are known about but remain exceptionally difficult to detect - particularly in a timely manner. We believe that insider attacks are of particular concern in a cloud-computing environment, and that cloud-service providers should enhance their ability to detect them by means of indirect detection. We propose a combined attack-tree and kill-chain based method for identifying multiple indirect detection measures. Specifically, the use of attack trees enables us to encapsulate all detection opportunities for insider attacks in cloud-service environments. Overlaying the attack tree on top of a kill chain in turn facilitates indirect detection opportunities higher-up the tree as well as allowing the provider to determine how far an attack has progressed once suspicious activity is detected. We demonstrate the method through consideration of a specific type of insider attack - that of attempting to capture virtual machines in transit within a cloud cluster via use of a network tap, however, the process discussed here applies equally to all cloud paradigms.

Day by day cyber crimes and attacks are growing exponentially, every year companies in worldwide lose billions of dollars due to cyber attacks. It has became very essential to investigate and indentify root of cyber attack. One of the popular techniques of investigating is Memory Forensics, which refers to analysis of volatile data in computer’s memory dump. Investigators conduct necessary memory forensics to investigate and identify attacks or malicious behaviours that do not leave easily detectable tracks on hard drive data. There are varieties of tools available for RAM analysis including Volatility, which currently dominates open source RAM forensic tools. However, use of volatility requires knowledge of command line tool and dynamic as well as static malware analysis; it becomes very complex and tedious process. The work mentioned in document is aimed to help forensic investigators and researchers by providing GUI based Tool for Automated Memory Forensics (AUMFOR). AUMFOR do perform all complex and tedious work automatically, it also analyzes and gives final accurate reports about possibilities of use of malware in committing a crime.

Memory forensics plays an important role in security and forensic investigations. Hence, numerous studies have investigated Windows memory forensics, and considerable progress has been made. In contrast, research on Linux memory forensics is relatively sparse, and the current knowledge does not meet the requirements of forensic investigators. Existing solutions are not especially sophisticated, and their complicated operation and limited treatment range are unsatisfactory. This paper describes an adaptive approach for Linux memory analysis that can automatically identify the kernel version and recovery symbol information from an image. In particular, given a memory image or a memory snapshot without any additional information, the proposed technique can automatically reconstruct the kernel code, identify the kernel version, recover symbol table files, and extract live system information. Experimental results indicate that our method runs satisfactorily across a wide range of operating system versions.

Owing to the significant and continuous development of cloud computing technology and the increasing number of cloud service providers (CSPs) that have emerged, CSP selection has become a challenging decision for many organizations. To accurately evaluate the services provided by various CSPs, many independent criteria must be considered, resulting in a multi-criteria decision-making (MCDM) problem. In MCDM problems, several alternatives are assessed against several criteria to identify the optimal alternative (s). The challenges stem from complex computation as well as less consistency, resulting in less reliable results. In this paper, a new method, called the best-only method (BOM), is proposed for solving the CSP selection problem, which is viable, efficient, and fully consistent. The proposed method was evaluated and validated using a use-case scenario, demonstrating its efficiency and appropriateness. The proposed method is compared with two popular MCDM methods, analytical hierarchical process (AHP) and best-worst method (BWM), from three perspectives: efficiency, consistency ratio (CR), and total deviation (TD). Based on the obtained results, AHP and BWM require 75.3% and 46.2% more comparisons, respectively, than the proposed method. The consistency ratios for AHP, BWM, and the proposed method were 37.92%, 13.35%, and 0%, respectively. The total deviations are 21.26, 8.65, and 0 for AHP, BWM, and the proposed method, respectively. These results clearly indicate that the proposed method outperforms AHP and BWM in terms of computing complexity and consistency, making it more efficient and reliable.

Protection of intellectual property is a well researched area of computer science. There are many methods that allow securing information that should not be available to unauthorized parties. Many of these techniques provide protection on a relatively low level such as file encryption or filtering of network traffic. However, many of the mechanisms fail as soon as someone attempts to save the content of the screen that is displaying the sensitive data. Such a malicious insider can cause serious harm to an organization's reputation and finances. It is important in case of such incidents to be able to track the source of the leak. In this paper a method for watermarking the screen image, that can be used in forensic investigations, is presented. The imperceptible digital watermark is placed on the overlay layer over the whole computer screen. Our method leverages the Human Visual System (HVS) properties and allows to generate dynamically adaptable watermarks that respond to the currently displayed content by using the FAST feature detection algorithm. We use QR Codes that provide spatial non-uniformity and error correction capabilities. The evaluation shows that our scheme works well in the selected use-case scenarios. We show that the watermark is robust against modifications typical for office processing, such as cropping and quality preserving JPEG compression.

In recent years, ransomware attacks have exploded globally, and it has become one of the most significant cyber threats to digital infrastructure. Such attacks have been targeting ranging from individuals to critical infrastructure or large organizations such as large commercial companies, energy facilities, medical centers and government departments. Ransomware attackers use sophisticated encryption techniques to hijack victims’ files in exchange for a large ransom to release encrypted data. Sophisticated encryption techniques make it almost impossible for victims to recover data without the secret key in the event of such an attack. To protect systems from ransomware threats, malicious activities had better be detected earlier, preferably before they engage in harmful behavior. Numerous studies have focused on ransomware threats and attempted to provide detection and prevention solutions for ransomware attacks, but none of the surveys explored the early detection of ransomware and highlighted challenges and issues with existing solutions. This survey fills this gap and provides a state-of-the-art overview of research on ransomware early detections. Moreover, we investigate the latest ransomware surveys and give an overview of the categories of ransomware from different perspectives, the evolution and attack process of ransomware, and provide datasets used for ransomware detection. Finally, the possible future research directions are discussed.

A hybrid multi criteria decision method for cloud service selection from Smart data

Network forensic investigation in OpenFlow networks with ForCon

The problem of an insider threat is a serious concern within organizations. It has been said that the weakest link in information security is the human element. Various causes of insider threats have been hypothesized. However, because there are so many potential causes of malicious insider threats, which factor has the greatest influence in inducing such threats remains unclear. In this paper, we focus on the most significant factor: sharing credentials. The objective of our study is to clarify the influence on the occurrence of malicious activities based on whether a credential is shared and whether a login ID is used. We conducted an experiment on a crowdsourcing service, Crowdworks, Inc., consisting of 198 participants to examine human behavior when attempting to perform malicious activities. Our results show that a non-indicated login ID has a statistically significant effect.

Private browsing is popular for many users who wish to keep their internet usage hidden from other users on the same computer. This research examines what artefacts are left on the users' computer using digital forensic tools. The results from this research help inform recommendations for forensic analysts on ways to analyse private browsing artefacts.

Malware threats are rapidly evolving to use more sophisticated attacks. By abusing rich application APIs such as Objective-C’s, they are able to gather information about user activity, launch background processes without the user’s knowledge as well as perform other malicious activities. In some cases, memory forensics is the only way to recover artifacts related to this malicious activity, as is the case with memory-only execution. The introduction of the Rosetta 2 on the Apple M1 introduces a completely new attack surface by allowing binaries of both Intel x86 64 and ARM64 architecture to run in userland. For this reason it is important that forensic analysis tools are able to properly identify indicators of malicious activity in a memory sample as well as include support for new platforms as soon as possible. In this paper, I present a memory analysis of the Rosetta 2 runtime using the Volatility Framework, a set of curated memory samples to help validate Volatility plugins and algorithms, and discuss new contributions to the Volatility support of the M1 platform.