Digital Forensics and Cyber Crime: 11th EAI International Conference, ICDF2C 2020, Boston, MA, USA, October 15-16, 2020, Proceedings (Lecture Notes of ... and Telecommunications Engineering)

This book constitutes the refereed proceedings of the 11th International Conference on Digital Forensics and Cyber Crime, ICDF2C 2020, held in Boston, MA, in October 2020. Due to COVID-19 pandemic the conference was held virtually. The 11 reviewed full papers and 4 short papers were selected from 35 submissions and are grouped in topical sections on digital forensics; cyber-physical system Forensics; event reconstruction in digital forensics; emerging topics in forensics; cybersecurity and digital forensics. Preface Conference Organization Contents On Reliability of JA3 Hashes for Fingerprinting Mobile Applications 1 Introduction 1.1 Contribution 1.2 Structure of the Text 2 Related Work 3 How JA3 Fingerprinting Works 3.1 Impact of TLS Library on JA3 Hashes 3.2 Randomized Values in TLS Extensions 3.3 Ads and Tracking Services in TLS Traffic 3.4 Time Stability of JA3 Hashes 4 Identification of Mobile Apps Using TLS Fingerprinting 4.1 Learning TLS Fingerprints 4.2 Detection of Mobile Applications Using TLS Fingerprints 4.3 Stability and Reliability of TLS Fingerprinting 5 Experiments 5.1 Datasets 5.2 Results 6 Application to Digital Forensics 7 Conclusion References Make Remote Forensic Investigations Forensic Again: Increasing the Evidential Value of Remote Forensic Investigations 1 Introduction 1.1 Contributions 1.2 Roadmap 2 Legal Perspective 2.1 Legislation Allowing Remote Forensic Investigations 2.2 Principle of Proportionality (Europe) 2.3 Balancing Test (US) 2.4 Requirements for Digital Evidence 3 ARMv8-A TrustZone Preliminaries 4 Design 4.1 Deployment 4.2 Extraction 4.3 Exfiltration 5 Implementation 5.1 Physical Memory Access 5.2 REE Virtual Address Resolution 5.3 Task List Traversal 5.4 Page Table Traversal 5.5 Data Extraction 5.6 Prototype Limitations 6 Evaluation 6.1 Target Application 6.2 Effectiveness 6.3 Performance 6.4 Compatibility 6.5 Legal Requirements 7 Related Work 8 Conclusions References Evidence Gathering in IoT Criminal Investigation 1 Introduction 2 The Need for a Forensic Data Collection Framework 2.1 Connected Objects as Evidence Receptacles 2.2 Problem 3 Previous Work 3.1 Literature Review 3.2 Specific Constraints 4 Collection Framework and Tools 4.1 Crime Scene Data Collection 4.2 The Sealing 4.3 Process to Follow 5 Evaluation of Forensic Tools in an Investigative Exercise 5.1 Presentation of the Scenario 5.2 Presentation of the Environment 5.3 Application of the Collection Methodology 6 Operational Impact Factor 7 Conclusion References Effective Medical Image Copy-Move Forgery Localization Based on Texture Descriptor 1 Introduction 2 Proposed Method 2.1 Feature Extraction 2.2 Feature Matching 2.3 Forgery Localization 3 Experiment Results 3.1 Evaluation Under Plain Copy-Move Attack 3.2 Evaluation Against Different Attacks 3.3 Evaluation of Different Phases 4 Conclusion References A Partial Approach to Intrusion Detection 1 Introduction 1.1 Contribution of This Work 1.2 Structure of This Work 2 Related Work 3 Dataset 4 Methodology 5 Results 6 Discussion 7 Conclusion 7.1 Future Work References Efficient Fingerprint Matching for Forensic Event Reconstruction 1 Introduction 1.1 Related Work 1.2 Contribution 1.3 Outline 2 Background 2.1 System Call Tracing 2.2 Forensic Fingerprint Calculation 3 Experimental Setup 3.1 Scenario and Attacker Model 3.2 Architecture and Implementation 4 Characteristic Fingerprints of a Large Event Set 4.1 Event Set 4.2 Results 5 Matching 5.1 Methodology 5.2 Matching Results 6 System Calls for Forensic Event Reconstruction 6.1 System Call Distribution in System Activity and in Characteristic Fingerprints 6.2 The Cost Function 6.3 Greedy Elimination of Expensive System Calls 7 Conclusion and Future Work References Modelling GOP Structure Effects on ENF-Based Video Forensics Abstract 1 Introduction 2 Related Works 3 ENF-Based Video Forensics 4 GOP Structure Effects on ENF Signal 4.1 Basics of Video Coding 4.2 Modelling Compression Artifacts 5 Results and Discussions 5.1 Experimental Settings 5.2 Reference ENF Acquisition 5.3 ENF Extraction from Raw Frames 5.4 Constant GOP Size 5.5 Variable GOP Size 5.6 Variable Bitrates with Different GOP Sizes 5.7 Discussions and Applications 6 Conclusions References Android Dumpsys Analysis to Indicate Driver Distraction Abstract 1 Introduction 2 Related Work 3 Analysis Background and Methodology 3.1 Introduction to Android Dumpsys 3.2 Evidence Identification 3.3 Post-acquisition Stage 3.4 Limitations 4 Core Dumpsys Services to Indicate Driver Distraction 4.1 Application Activities 4.2 Application Usage Statistics 4.3 WiFi Analytics and Screen Activities 4.4 Login Activities 4.5 Telephony Activities 4.6 Bluetooth 4.7 SSRM Service (CustomFrequencyManagerService) 5 Synthetic Case Study and Results 5.1 Results 6 Conclusion 7 Future Work Acknowledgments References Adapting to Local Conditions: Similarities and Differences in Anonymous Online Market Between Chinese and English Speaking Communities 1 Introduction 2 Anonymous Online Market Overview and Data Collection 2.1 Anonymous Online Market Overview 2.2 Data Collection 3 Comparative Analysis of Anonymous Online Market in Chinese and English 3.1 Market Operation Mechanism 3.2 Market Security Mechanism 3.3 Goods Sales Situation 4 Discussion 4.1 Ethical Considerations 4.2 Law Enforcement Intervention and Anonymous Online Market Governance 4.3 Market Demand and Vendor Behavior 5 Related Work 6 Conclusion References Remote Air-Gap Live Forensics Abstract 1 Introduction 2 Scenario 2.1 Problem 2.2 Importance of Remote Live Air-Gap Forensics 3 Approach 3.1 Common Approach and Its Risks 3.2 Proposed Approach 3.3 Overview 4 Goals 4.1 Can it perform remote live forensics on an air-gap system? 4.2 Is It Scalable? 4.3 Has It a Small Footprint? 4.4 Is It Able to Respect ACPO Rule 2? 4.5 Is It Cheap? 5 Conclusion 6 Future Work 6.1 Capabilities 6.2 Security 7 Stabilization and Limitation Acknowledgements References A Digital Forensic Approach for Optimizing the Investigation of Hit-and-Run Accidents 1 Introduction 2 Related Work 3 Digital Forensic Approach 3.1 Inspection Phase 3.2 Data Analysis Phase 4 Investigating Likely Routes 4.1 Reconstruction of Likely Routes 4.2 Analysis of Likely Routes 5 Investigating Driving Behavior 5.1 Severity of Driving Maneuvers 5.2 Analysis of Driving Behavior 6 Evaluation 6.1 Data Sets 6.2 Investigation of Likely Routes 6.3 Investigation of Driving Behavior 6.4 Using the Digital Forensic Approach in an Investigation 7 Conclusion References An Intelligence Criminal Tracker for Industrial Espionage Abstract 1 Introduction 2 Related Works 3 Intelligence Criminal Tracker (ICT) 4 Investigation Methodology 4.1 Extracting 4.2 Ranking 4.3 Grouping 4.4 Profiling 5 Data Acquisition and Reporting 6 Conclusions References Retracing the Flow of the Stream: Investigating Kodi Streaming Services 1 Introduction 2 Related Work 3 Findings and Analysis for Kodi on Windows 4 Examining Kodi Installed on Android and Linux 5 Discussion 6 Conclusion and Future Work References Cybersecurity Methodology for Specialized Behavior Analysis 1 Introduction 2 Related Work 3 Methodology Design 3.1 Questionnaires 3.2 Theoretical Education 3.3 Practical Education 3.4 Implementation and Experimentation 3.5 Model Creation/Validation 4 Conclusions and Future Work References Neural Representation Learning Based Binary Code Authorship Attribution 1 Introduction 2 The Approach 2.1 Feature Extraction Based on Structure 2.2 Feature Extraction Based on Sequence 2.3 Tree Structure Classifier 3 Experimental Evaluation 3.1 Dataset 3.2 Evaluation 4 Conclusion References Author Index This book contains a selection of thoroughly refereed and revised papers from the Third International ICST Conference on Digital Forensics and Cyber Crime, ICDF2C 2011, held October 26-28 in Dublin, Ireland. The field of digital forensics is becoming increasingly important for law enforcement, network security, and information assurance. It is a multidisciplinary area that encompasses a number of fields, including law, computer science, finance, networking, data mining, and criminal justice. The 24 papers in this volume cover a variety of topics ranging from tactics of cyber crime investigations to digital forensic education, network forensics, and the use of formal methods in digital investigations. There is a large section addressing forensics of mobile digital devices.