Cybersecurity Investigations and Digital Forensics

Permanent URI for this collection

https://hdl.handle.net/10125/63733

Browse

Recent Submissions

Now showing 1 - 3 of 3
  • Item
    Container and VM Visualization for Rapid Forensic Analysis
    ( 2020-01-07) Shropshire, Jordan ; Benton, Ryan
    Cloud-hosted software such as virtual machines and containers are notoriously difficult to access, observe, and inspect during ongoing security events. This research describes a new, out-of-band forensic tool for rapidly analyzing cloud based software. The proposed tool renders two-dimensional visualizations of container contents and virtual machine disk images. The visualizations can be used to identify container / VM contents, pinpoint instances of embedded malware, and find modified code. The proposed new forensic tool is compared against other forensic tools in a double-blind experiment. The results confirm the utility of the proposed tool. Implications and future research directions are also described.
  • Item
    DNA Feature Selection for Discriminating WirelessHART IIoT Devices
    ( 2020-01-07) Rondeau, Christopher ; Temple, Michael
    This paper summarizes demonstration activity aimed at applying Distinct Native Attribute (DNA) feature selection methods to improve the computational efficiency of time domain fingerprinting methods used to discriminate Wireless Highway Addressable Remote Transducer (WirelessHART) devices being used in Industrial (IIoT) applications. Efficiency is achieved through Dimensional Reduction Analysis (DRA) performed here using both pre-classification analytic (WRS and ReliefF) and post-classification relevance (RndF and GRLVQI) feature selection methods. Comparative assessments are based on statistical fingerprint features extracted from experimentally collected WirelessHART signals, with Multiple Discrimination Analysis, Maximum Likelihood (MDA/ML) estimation showing that pre-classification methods are collectively superior to post-classification methods. Specific DRA results show that an average cross-class percent correct classification differential of 8% ≤ %CD ≤ 1% can be maintained using DRA selected feature sets containing as few as 24 (10%) of the 243 full-dimensional features. Reducing fingerprint dimensionality reduces computational efficiency and improves the potential for operational implementation.
  • Item
    Introduction to the Minitrack on Cybersecurity Investigations and Digital Forensics
    ( 2020-01-07) Glisson, William ; Grispos, George ; Choo, Kim-Kwang Raymond