Memory Volatile Forensik untuk mendeteksi malware menggunakan algoritma machine learning

Today, cloud computing has developed a transformative model for the organization, business, governments that brings huge potentials and turn into popular for pay as you go, on-demand service, scalability and efficient services. However, cloud computing has made the concern for forensic data because of the architecture of cloud system is not measured appropriately. Due to the distributed nature of the cloud system, many aspects relating to the forensic investigation such as data collection, data storage, crime target, data violation are difficult to achieve. Investigating the incidents in the cloud environment is a challenging task because the forensics investigator still needs to relay on the third party such as cloud service provider for performing their investigation tasks. It makes the overall forensic process difficult to complete with a duration and presented it to the court. Recently, there are some cloud forensics studies to address the challenges such as evidence collection, data acquisition, identifying the incidents and so on. However, still, there is a research gap in terms of consistency of analysing forensic evidence from distributed environment and methodology to analyse the forensic data in the cloud. This thesis contributes towards the direction of addressing the research gaps. In particular, this work proposes a forensic investigation framework CeFF: A framework for forensics enabled cloud investigation to investigate evidence in the cloud computing environment. The framework includes a set of concepts from organisational, technical and legal perspectives, which gives a holistic view of analysing cybercrime from organisation context where the crime has occurred through technical context and legal impact. The CeFF also includes a systematic process that uses the concept for performing the investigation. The cloud-enabled forensics framework meets all the forensics related requirement such as data collection, examination, presents the report, and identifies the potential risks that can consider while investigating the evidence in the cloud-computing environment. Finally, the proposed CeFF is applied to a real-life example to validate its applicability. The result shows that CeFF supports analysing the forensic data for a crime occurred in cloud-based system in a systematic way.

Virtualization in computing has progressed to an extent where desktops can be virtualized and accessed from anywhere. The server hosted model has already surpassed 1% market share of the worldwide professional PC market, with estimates indicating that this is a rapidly growing area. This paper investigates the adequacy of current digital forensic procedures on hosted virtual desktops (HVDs) as there does not appear to be specific methods of locating and extracting evidences from this infrastructure. A hosted virtual desktop deployed in private clouds was simulated to reflect two different computer crime scenarios. It was found that current digital forensic procedures may not be adequate for locating and extracting evidence, since the infrastructure introduces complications such as persistent/non-persisted disk modes and segregating data in a multi-tenant environment.

This thesis explores the feasibility of testing for drugs from a fingerprint. Previous publications have reported drug detection in fingerprints from either drug users or after contact with a substance. There are possibilities to exploit these findings either for forensics (where a finger-mark is deposited at a crime scene to give intelligence about a donor) or for drug testing (where fingerprints are deposited under controlled conditions). In forensic science, it may be sufficient to know that a drug has been either handled or ingested within a specific time frame. In contrast, for drug testing, it may be necessary to exclude handling of drugs as a possible source. In either case, it is necessary to understand the significance of detecting a drug or its metabolite in a fingerprint. This thesis explored the significance of detecting a selection of illicit drugs in fingerprints. In Chapter 4 and Chapter 5, a rapid analysis method based on paper spray high resolution mass spectrometry is developed and validated for cocaine and its metabolite, benzoylecgonine (BZE), and the method is applied to the fingerprints of non-drug users and drug users respectively. As a result, cocaine and BZE were found in samples from both non-drug users (set as environmental cut-off) and drug users. The detection rate from drug users was above 90 % and there were no false positive using this method. Moreover, handwashing involvement became indicative of either ingestion of cocaine OR recent contact with cocaine. In Chapter 6 and 7, imaging mass spectrometry techniques were employed to determine whether contact and ingestion scenarios can be distinguished via spatial distribution of analytes. Those results supported the hypothesis that hot spots would be formed in fingerprints after contact whereas analytes would be evenly distributed in fingerprints after ingestion. The presence of BZE was also used to in distinguishing fingerprint samples from the two scenarios. In Chapter 8 and 9, the paper spray mass spectrometry methodology was expanded to a selection of novel psychoactive substances (NPS) relevant to a prison environment using fingerprints for the first time. The method was applied to the fingerprints of prisoners before and after participants washed their hands. As a result, NPS substances were not detected from any participants, in agreement with their urine testing. Finally, in Chapter 10, the data collected in Chapter 4 and 5 was analysed retrospectively for detection of heroin and 6-AM in fingerprints to explore the possibility of carrying out an untargeted analysis. The sensitivity of the method was not as good as for cocaine and benzoylecgonine (BZE), which led to the lower detection rate of heroin and 6-AM than that of cocaine and BZE. However, this study proved that the paper spray method could still provide qualitative and quantitative results of heroin detection in fingerprints. This study demonstrates that in the future with a suitable, deployable high resolution mass spectrometer, paper spray mass spectrometry could be used to detect cocaine, its metabolites and NPS for evidential purposes within the confines of a police station.

Network forensics is the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents. Network forensics is a sub-branch of digital forensics. Network device forensics is also a sub-branch of network digital forensics. Forensic IT applications and examination of suspicious users` personal computers to be copied to all of the data alone is not sufficient for the determination of guilt or innocence. Users before the event and during the event is logged on the network traffic to be carried out is important. These records are necessary to preserve the security measures on the network devices, the devices required by the user on the network can not use, the internet user`s IP address and MAC address of the output to be significant, the user attempts to disrupt the functioning of the network is very important in minimizing. Users, network devices must not interfere with the records. In this study, as well as to facilitate network forensics investigations on network devices to improve network security configuration settings to be discussed.

Information technology systems are attacked by offenders using digital devices and networks to facilitate their crimes and hide their identities, creating new challenges for digital investigators. Malicious programs that exploit vulnerabilities also serve as threats to digital investigators. Since digital devices such as computers and networks are used by organisations and digital investigators, malicious programs and risky practices that may contaminate the integrity of digital evidence can lead to loss of evidence. For some reasons, digital investigators face a major challenge in preserving the integrity of digital evidence. Not only is there no definitive comprehensive model of digital forensic investigation for ensuring the reliability of digital evidence, but there has to date been no intensive research into methods of doing so. To address the issue of preserving the integrity of digital evidence, this research improves upon other digital forensic investigation model by creating a Comprehensive Digital Forensic Investigation Model (CDFIM), a model that results in an improvement in the investigation process, as well as security mechanism and guidelines during investigation. The improvement is also effected by implementing Proxy Mobile Internet Protocol version 6 (PMIPv6) with improved buffering based on Open Air Interface PIMIPv6 (OAI PMIPv6) implementation to provide reliable services during handover in Mobile Node (MN) and improve performance measures to minimize loss of data which this research identified as a factor affecting the integrity of digital evidence. The advantage of this is to present that the integrity of digital evidence can be preserved if loss of data is prevented. This research supports the integration of security mechanism and intelligent software in digital forensic investigation which assist in preserving the integrity of digital evidence by conducting experiments which carried out two different attack experiment to test CDFIM. It found that when CDFIM used security mechanism and guidelines with the investigation process, it was able to identify the attack and also ensured that the integrity of the digital evidence was preserved. It was also found that the security mechanism and guidelines incorporated in the digital investigative process are useless when the security guidelines are ignored by digital investigators, thus posing a threat to the integrity of digital evidence.

Due to the unprecedentedly ubiquitous wireless computer networks and mobile devices become prevalent, more unscrupulous technology hacktivists commit illegal conspiracies towards innocent victims via the ever growing Internet technology. Indeed, cybercrimes are relentlessly reported worldwide. The law enforcement agencies have the indispensable responsibility to crack the well-funded crime syndicate in our computer society. Consequently, Digital Forensics (DF) emerges and becomes the critical success factor to prosecute the culprit and prevent the associate cybercrime incidents from occurring. In the meanwhile, the computer society has an urgent demand for competent DF professionals to gather convincing digital evidences to assist indicting heinous perpetrators in order to allay the fears of everlasting computer crimes events in both private and public sectors. The research provides a vivid roadmap and suggested core curriculum design guidelines for higher education institutions to be integrated into their existing similar program or adopting as a groundbreaking reference model. A serial, cross-discipline, and functional approach were combined in order to design the suggested curriculum. Furthermore, the paper is attempting to minimize the theorypractice gap in DF and provide a milestone for higher education institutions to contemplate if necessary.

With the development of intelligent perception, recognition technology and pervasive computing, Internet of things(IoT) is widely used, the security problem is also concerned by more and more researchers. IoT is a double-edged sword. On the one hand, it has great potential in simplifying the business process and provides an effective way for the enterprise to interact with the customers. But on the other hand, it also provides convenience for cyber crimes and hackers.First of all, Three layers logic architecture of IoT is introduced, and the security problems at each level and the key points of the research are expounded, and then the security requirements are analyzed. The main causes of security problems are summarized and analyzed:physical attack and the threat of equipment and malware, file attack and hacker attack. Finally, through the application of the existing technology in IoT environment, the exploration of new technology and the security of the hardware related to IoT, the security of the software and the security team, the future research direction of the security of IoT is pointed out.

Nowadays, most of the reported cybercrimes use the Internet. It is seen that Web Browsers leave forensically sound footprints of Internet browsing activities on the computer’s storage media. The traces once retrieved stand as crucial hints that help the investigator to reconstruct various events that the suspect has done. However, the usage of private or portable web browsers prevents the creation of those files on the Suspect’s Computer. This makes the job of investigators more challenging. But, the remnants of browsing activities done using any web browser is recorded in the Physical Memory of the Computer. Hence, analyzing the Physical Memory Dump of the suspect's machine, collected as part of Live Forensics, may provide lots of forensically sound evidence related to the Internet-related activities in a cybercrime investigation. This information provides highly crucial information which can render hints in the investigation process. One of the most important features of any Cyber Forensics Analysis Tool is keyword searching. But identifying and finalizing the keywords to be searched during the analysis process in a particular Cyber Crime is always challenging for the investigators. The task of retrieving searched keywords is crucial as it directly provides the criminal background of the Suspect if any. This information enables cyber forensics investigators to conduct a focused approach while analyzing the evidence. This paper mainly presents a novel methodology for the reconstruction of searched keywords from the Physical Memory Dump collected from the Suspect’s Windows 10 Computers. A methodology for retrieving keywords from the browser files generated by Web Browsers in the storage media has also been described. The keywords retrieved in this way helps the Investigators to identify the associated highly crucial information during the deep-dive analysis of the storage media in Offline Forensic Analysis.

Abstract: With the evolution of man, technology has also evolved day by day, man has started relying upon the technologies, thus easing his burdens up. According to reports, it is expected that by 2020, 80% of adults on earth will have a smart phone on an average there has been a growth of 936%from 2000-2017 in the total population connected to internet. These figures are quite good on the part of technological progress, but at the same time pose a great threat to security issues for data on internet. The increasing rate of cyber crimes in past years is a threat to the data preserved via internet. This is the need of the hour to put a check on the rate with which cyber crimes have been increasing. A check point in this regard is the lack of highly automated tools and equally less number of forensic investigators. Thus the need of time is the possibility of such an intelligent frame work, which can share the burden of forensic cyber crime or digital forensics investigators.

Cloud computing is evolving web based technology. Which provide various service to physical IT infrastructure which is managed and hosted by third party. Features due to which cloud find its application in E-learning, cloud based ERP and E-governance are flexibility, availability, scalability, efficiency and reliability. As large number of computing technology is involved in cloud computing it is an object of security issues. In this research, we have discussed about basics of cloud computing, features, models, application, security issue, basics of digital forensics and cloud forensic as well as the challenges faced during the cloud investigation. Keywords :Cloud computing, E-governance, cloud ERP, E-learning, Forensic, Cloud Forensics

Enhancing forensic investigations: Identifying bloodstains on various substrates through ATR-FTIR spectroscopy combined with machine learning algorithms

Malicious code is one of the biggest threats to cyberspace. In all kinds of network security incidents, malicious code is the main attack vector. At present, the traditional malicious code analysis methods based on feature and signature cannot meet the requirement of detection of malicious code. It is urgent for anti-virus manufacturers to explore and research more accurate and efficient malicious code detection and countermeasure mechanism. Through analyzing the format structure information of malicious code samples and combining with the extreme learning machine algorithm in machine learning, this paper studies the malicious code classification technology on the basis of the existing research, and designs the classification algorithm of malicious code family based on extreme learning. Experimental results show that the proposed technical method can effectively realize the classification of malicious code family, with the accuracy of classification more than 90%.

This book offers a comprehensive and integrative introduction to cybercrime. It provides an authoritative synthesis of the disparate literature on the various types of cybercrime, the global investigation and detection of cybercrime and the role of digital information, and the wider role of technology as a facilitator for social relationships between deviants and criminals. It includes coverage of: • key theoretical and methodological perspectives; • computer hacking and malicious software; • digital piracy and intellectual theft; • economic crime and online fraud; • pornography and online sex crime; • cyber-bullying and cyber-stalking; • cyber-terrorism and extremism; • the rise of the Dark Web; • digital forensic investigation and its legal context around the world; • the law enforcement response to cybercrime transnationally; • cybercrime policy and legislation across the globe. The new edition has been revised and updated, featuring two new chapters; the first offering an expanded discussion of cyberwarfare and information operations online, and the second discussing illicit market operations for all sorts of products on both the Open and Dark Web. This book includes lively and engaging features, such as discussion questions, boxed examples of unique events and key figures in offending, quotes from interviews with active offenders, and a full glossary of terms. It is supplemented by a companion website that includes further exercises for students and instructor resources. This text is essential reading for courses on cybercrime, cyber-deviancy, digital forensics, cybercrime investigation, and the sociology of technology.

ABSTRACTModern time largely rely on mobile gadgets as a means of communication, and entertainment. These gadgets now plays a vital role in forensic analysis and criminal investigations as it store a plethora of private and sensitive data. Investigating feasible digital incidents and preserving mobile device security became crucial as the proliferation of mobile devices continues to influence modern society. In this survey; mobile threats, investigative process models for mobile forensics, evidence sources, forensics tools, and field problems are all covered in‐depth. Further, a comprehensive analysis examining the capabilities, features, and efficiency of available distinct mobile forensic tools namely Belkasoft, MOBILedit, and Magnet AXIOM for retrieving, analyzing, and presenting digital evidence is being presented. The objective of the study is to assist forensic investigators in choosing the best tool for specific investigations. The findings of our study reveals the complexity of mobile operating systems, investigative process supported with sources of evidence, and forensic tools which makes it clear that the area of mobile forensics is dynamic and require modern skill adaptation along and innovative development in future. Finally, the study presents current challenges encountered during mobile forensic investigations as researchers can enhance their procedures and tactics for mobile device examination and evidence extraction by fostering a greater knowledge of the difficulties involved in mobile forensics.

<p> Time is of the essence during the data acquisition phase of a forensic structural investigation; the preservation of post-failure site conditions may be limited and access to the site may be restricted. The acquisition of accurate and timely information from the field is a vital component of every forensic structural investigation and often occurs during limited time frames. Laser scanners and vibration sensors are becoming ubiquitous on construction sites. Collection and processing of laser scan data, correlated with vibration and other sensors, can be effective for assessing the condition of an existing building or for collecting forensic information after a failure or collapse. The automatic collection of data creates new challenges: how to effectively sift through the wealth of information provided by the scanning and sensing devices. A good engineer in the field can accurately describe a structure with only hundreds of measurements. A laser scanner on the other hand takes thousands of points of information. Case studies of forensic investigations that have used laser scan technology and vibration sensors will be presented along with ideas for how to enrich our forensic tools with the growing wealth of available devices.</p>