Search

The importance of demonstrating the correctness of forensic analysis tools and automated incident management tools reinforces the need for a finite state machine (FSM) engine that can generate automated forensic processes. Hence, in this paper, we present an event‐based FSM representation for Cloud Forensic Readiness as a Service (CFRaaS), where we also show how the FSM's predetermined states and transitions could be used to formulate an automated forensic process and generate a hypothesis for litigation purposes. Specifically, this proposition comprises a two‐step level CFRaaS‐FSM with possible transitions and states. This representation is useful because it can alert digital forensic investigators on how to deduce current and next state of attacks based on transitions and current states. [ABSTRACT FROM AUTHOR]

In our interconnected cyber‐physical world, the types and number of Internet of Things (IoT) will also increase. Such devices are also generally capable of capturing a broad range of information, including digital artifacts that can facilitate a digital investigation during a cyber security incident (e.g., data breach). In other words, IoT devices are potential evidence acquisition sources. We posit the importance of having a digital forensic black‐box, conceptually similar to the cockpit voice recorder (also known as a flight recorder) on aircrafts, to facilitate digital investigations. Using a smart home comprising many different IoT devices (e.g., smart home devices, smart vehicles, and smart wearables) as an example, we discuss where such a black‐box can reside and what sort of artifacts can be collected. This black‐box can also complement other existing digital forensic readiness strategies, such as those described in ISO/IEC 27043:2015. We also explore the associated design requirements such as data provenance. There are changes required to the organization's current computing architecture in order to deploy our proposed black‐box, as explained in this paper. In addition, we will explore the potential privacy implications and potential research opportunities (e.g., blockchain‐based digital forensic black‐box). This article is categorized under:Digital and Multimedia Science > Cloud ForensicsDigital and Multimedia Science > IoT Forensics [ABSTRACT FROM AUTHOR]

Blockchain is increasingly deployed in a broad range of sectors, ranging from banking and finance to manufacturing to energy to transportation, and so on. While many technological and business related blockchain developments and challenges have been identified, many of these engineering and management challenges have not been addressed. The ongoing interest in this topic is also partly evidenced by the large number of submissions we received in this special issue. Of the 200 submissions, only 39 articles were eventually accepted after several rounds of rigorous reviews (i.e., acceptance rate of 19.5%). In this editorial, we report on the findings from the first 36 articles on a broad range of topics (e.g., supply chain, financial technology, Internet of Things, smart city, healthcare, security, privacy, and blockchain building blocks such as consensus algorithms). Hopefully, the findings reported in these 36 accepted articles will provide sustainable solutions for existing and future blockchain systems and platforms. [ABSTRACT FROM AUTHOR]

Blockchain is a relative recent research and technological trend, with applications in diverse domains including those associated with a nation's critical infrastructure sectors (e.g., chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, and energy). The interest in blockchain is also partly evidenced by the number of submissions we received in this special issue. Of the 54 submissions received, 18 papers were accepted after several rounds of reviews by subject matter experts (i.e., acceptance rate of ∼ 33.3%). This special issue presents the research advances and describes existing and emerging challenges outlined in these 18 accepted papers, authored by researchers from institutions in Australia, Canada, China, Denmark, Ireland, New Zealand, Spain, United Kingdom, and United States. These accepted papers also reinforce the importance of collaboration across institutions and countries. [ABSTRACT FROM AUTHOR]

Advances in technologies including development of smartphone features have contributed to the growth of mobile applications, including dating apps. However, online dating services can be misused. To support law enforcement investigations, a forensic taxonomy that provides a systematic classification of forensic artifacts from Windows Phone 8 (WP8) dating apps is presented in this study. The taxonomy has three categories, namely: Apps Categories, Artifacts Categories, and Data Partition Categories. This taxonomy is built based on the findings from a case study of 28 mobile dating apps, using mobile forensic tools. The dating app taxonomy can be used to inform future studies of dating and related apps, such as those from Android and iOS platforms. [ABSTRACT FROM AUTHOR]

In order to increase the security of edge computing, all data transmitted to and from edge devices, as well as all data stored on edge devices, must be encrypted. Especially when the transmitted or stored data contains sensitive personal information, long-term protection over periods of ten or more years may be required, which can only be achieved with post-quantum cryptography. This article first gives a brief overview of post-quantum public-key cryptosystems based on hard mathematical problems related to hash functions, error-correcting codes, multivariate quadratic systems, and lattices. Then the suitability of lattice-based cryptosystems for resource-constrained devices is discussed and efficient implementations for 8 and 32-bit microcontrollers are outlined. [ABSTRACT FROM AUTHOR]

In this paper, we review literature on antiforensics published between 2010 and 2016 and reveal the surprising lack of up-to-date research on this topic. This research aims to contribute to this knowledge gap by investigating different antiforensic techniques for devices running Windows 7, one of the most popular operating systems. An approach which allows for removal or obfuscation of most forensic evidence is then presented. Using the Trojan software DarkComet RAT as a case study, we demonstrate the utility of our approach and that a Trojan Horse infection may be a legitimate possibility, even if there is no evidence of an infection on a seized computer's hard drive. Up-to-date information regarding how forensic artifacts can be compromised will allow relevant stakeholders to make informed decisions when deciding the outcome of legal cases involving digital evidence. [ABSTRACT FROM AUTHOR]

An Android social app taxonomy incorporating artifacts that are of forensic interest will enable users and forensic investigators to identify the personally identifiable information ( PII) stored by the apps. In this study, 30 popular Android social apps were examined. Artifacts of forensic interest (e.g., contacts lists, chronology of messages, and timestamp of an added contact) were recovered. In addition, images were located, and Facebook token strings used to tie account identities and gain access to information entered into Facebook by a user were identified. Based on the findings, a two-dimensional taxonomy of the forensic artifacts of the social apps is proposed. A comparative summary of existing forensic taxonomies of different categories of Android apps, designed to facilitate timely collection and analysis of evidentiary materials from Android devices, is presented. [ABSTRACT FROM AUTHOR]

Lightweight browsers on mobile devices are increasingly been used to access cloud services and upload / view data stored on the cloud, due to their faster resource loading capabilities. These browsers use client side efficiency measures such as larger cache storage and fewer plugins. However, the impact on data security of such measures is an understudied area. In this paper, we propose an adversary model to examine the security of lightweight browsers. Using the adversary model, we reveal previously unpublished vulnerabilities in four popular light browsers, namely: UC Browser, Dolphin, CM Browser, and Samsung Stock Browser, which allows an attacker to obtain unauthorized access to the user’s private data. The latter include browser history, email content, and bank account details. For example, we also demonstrate that it is possible to replace the images of the cache in one of the browsers, which can be used to facilitate phishing and other fraudulent activities. By identifying the design flaw in these browsers (i.e. improper file storage), we hope that future browser designers can avoid similar errors. [ABSTRACT FROM AUTHOR]

Mobile devices have become ubiquitous in almost every sector of both private and commercial endeavors. As a result of such widespread use in everyday life, many users knowingly and unknowingly save significant amounts of personal and/or commercial data on these mobile devices. Thus, loss of mobile devices through accident or theft can expose users—and their businesses—to significant personal and corporate cost. To mitigate this data leakage issue, remote wiping features have been introduced to modern mobile devices. Given the destructive nature of such a feature, however, it may be subject to criminal exploitation (e.g., a criminal exploiting one or more vulnerabilities to issue a remote wiping command to the victim's device). To obtain a better understanding of remote wiping, we survey the literature, focusing on existing approaches to secure flash storage deletion and provide a critical analysis and comparison of a variety of published research in this area. In support of our analysis, we further provide prototype experimental results for three Android devices, thus providing both a theoretical and applied focus to this article as well as providing directions for further research. [ABSTRACT FROM AUTHOR]

Due to the popularity of Android devices and applications (apps), Android forensics is one of the most studied topics within mobile forensics. Communication apps, such as instant messaging and Voice over IP (Vo IP), are one popular app category used by mobile device users, including criminals. Therefore, a taxonomy outlining artifacts of forensic interest involving the use of Android communication apps will facilitate the timely collection and analysis of evidentiary materials from such apps. In this paper, 30 popular Android communication apps were examined, where a logical extraction of the Android phone images was collected using XRY, a widely used mobile forensic tool. Various information of forensic interest, such as contact lists and chronology of messages, was recovered. Based on the findings, a two-dimensional taxonomy of the forensic artifacts of the communication apps is proposed, with the app categories in one dimension and the classes of artifacts in the other dimension. Finally, the artifacts identified in the study of the 30 communication apps are summarized using the taxonomy. It is expected that the proposed taxonomy and the forensic findings in this paper will assist forensic investigations involving Android communication apps. [ABSTRACT FROM AUTHOR]

Due to growing user demand, web application development is becoming increasingly complicated. Multiple programming languages along with the complex multi-tier architecture commonly involved in web application development contribute to the probability of programming mistakes. Such mistakes may cause serious security vulnerabilities, which can then be exploited by malicious users. Current classifications include a wide variety of web application vulnerabilities, such as SQL injections, Cross-Site Scripting and File Inclusion. Various different protections exist against attacks associated with these vulnerabilities making it difficult to apply a single universal solution. This paper takes an alternative view of the core root of the vulnerabilities. Based on the discovered common traits, a unified extensible context-based model of web applications is proposed. A concept of context is introduced and different attacks are reformulated in terms of context boundary violation. The proposed model can be used to implement a more universal web application protection suitable against different types of attacks. [ABSTRACT FROM AUTHOR]

Abstract: Smartphone devices are increasingly being integrated into a variety of medical settings. An emerging trend is the development of smartphone applications that interact with medical devices connected to the Internet. While this fusion of technology can provide various benefits for both patients and medical professionals, there are concerns that these devices could become targets for cybercriminals. Therefore, a digital forensic investigation of these medical devices could be needed. However, researchers have suggested that the investigation of medical devices is unlikely to be straightforward, and that conventional forensic evidence acquisition might not be possible. Hence, this paper proposes that smartphone applications, which interact with medical devices, could provide an alternative source of digital evidence when investigating the device itself. The research contribution is twofold. First, the paper presents an empirical investigation to using residual data recovered from medical smartphone applications, as a means for forensically examining medical devices. Second, the paper documents the forensic artifacts that are generated by specific medical device smartphone applications on Android and iOS smartphones. [ABSTRACT FROM AUTHOR]

A smart-card-based user authentication scheme for wireless sensor networks (hereafter referred to as a SCA-WSN scheme) is designed to ensure that only users who possess both a smart card and the corresponding password are allowed to gain access to sensor data and their transmissions. Despite many research efforts in recent years, it remains a challenging task to design an efficient SCA-WSN scheme that achieves user anonymity. The majority of published SCA-WSN schemes use only lightweight cryptographic techniques (rather than public-key cryptographic techniques) for the sake of efficiency, and have been demonstrated to suffer from the inability to provide user anonymity. Some schemes employ elliptic curve cryptography for better security but require sensors with strict resource constraints to perform computationally expensive scalar-point multiplications; despite the increased computational requirements, these schemes do not provide user anonymity. In this paper, we present a new SCA-WSN scheme that not only achieves user anonymity but also is efficient in terms of the computation loads for sensors. Our scheme employs elliptic curve cryptography but restricts its use only to anonymous user-to-gateway authentication, thereby allowing sensors to perform only lightweight cryptographic operations. Our scheme also enjoys provable security in a formal model extended from the widely accepted Bellare-Pointcheval-Rogaway (2000) model to capture the user anonymity property and various SCA-WSN specific attacks (e.g., stolen smart card attacks, node capture attacks, privileged insider attacks, and stolen verifier attacks). [ABSTRACT FROM AUTHOR]

We present the first provably-secure three-party password-only authenticated key exchange (PAKE) protocol that can run in only two communication rounds. Our protocol is generic in the sense that it can be constructed from any two-party PAKE protocol. The protocol is proven secure in a variant of the widely-accepted model of Bellare, Pointcheval and Rogaway (2000) without any idealized assumptions on the cryptographic primitives used. We also investigate the security of the two-round, three-party PAKE protocol of Wang, Hu and Li (2010) and demonstrate that this protocol cannot achieve implicit key authentication in the presence of an active adversary. [ABSTRACT FROM AUTHOR]

Abstract: National information infrastructure (NII), vital to the nation''s security and economic stability, comprises both physical and electronic infrastructures. Information and communications technologies (ICT) form the backbone of many aspects of the NII and reliance on ICT has created many new risks. Cyberthreats are becoming more sophisticated with the blending of once distinct types of attack into more damaging forms. This paper examines the technology-related risks associated with the NII and provides examples of existing incidents and areas in which new threats might emerge. To be able to mitigate these risks, it remains crucial to understand infrastructure interdependencies and to establish public-private partnerships to ensure that weaknesses in systems are not able to be exploited. [Copyright &y& Elsevier]

A modified version of the Bellare and Rogaway (1993) adversarial model is encoded using Asynchronous Product Automata (APA). A model checker tool, Simple Homomorphism Verification Tool (SHVT), is then used to perform state-space analysis on the Automata in the setting of planning problem. The three-party identity-based secret public key protocol (3P-ID-SPK) protocol of Lim and Paterson (2006), which claims to provide explicit key authentication, is used as a case study. We then refute its heuristic security argument by revealing a previously unpublished flaw in the protocol using SHVT. We then show how our approach can automatically repair the protocol. This is, to the best of our knowledge, the first work that integrates an adversarial model from the computational complexity paradigm with an automated tool from the computer security paradigm to analyse protocols in an artificial intelligence problem setting – planning problem – and, more importantly, to repair protocols. [ABSTRACT FROM AUTHOR]

We revisit the password-based group key exchange protocol due to Lee et al. (2004), which carries a claimed proof of security in the Bresson et al. model under the intractability of the Decisional Diffie–Hellman problem (DDH) and Computational Diffie–Hellman (CDH) problem. We reveal a previously unpublished flaw in the protocol and its proof, whereby we demonstrate that the protocol violates the definition of security in the model. To provide a better insight into the protocol and proof failures, we present a fixed protocol. We hope our analysis will enable similar mistakes to be avoided in the future. We also revisit protocol 4 of Song and Kim (2000), and reveal a previously unpublished flaw in the protocol (i.e., a reflection attack). [ABSTRACT FROM AUTHOR]

Blind signature is an important cryptographic primitive with widespread applications in secure e-commerce, for example to guarantee participants' anonymity. Existing blind signature schemes are mostly based on number-theoretic hard problems, which have been shown to be solvable with quantum computers. The National Institute of Standards and Technology (NIST) began in 2017 to specify a new standard for digital signatures by selecting one or more additional signature algorithms, designed to be secure against attacks carried out using quantum computers. However, none of the third-round candidate algorithms are code-based, despite the potential of code-based signature algorithms in resisting quantum computing attacks. In this paper, we construct a new code-based blind signature (CBBS) scheme as an alternative to traditional number-theoretic based schemes. Specifically, we first extend Santoso and Yamaguchi's three pass identification scheme to a concatenated version (abbreviated as the CSY scheme). Then, we construct our CBBS scheme from the CSY scheme. The security of our CBBS scheme relies on hardness of the syndrome decoding problem in coding theory, which has been shown to be NP-complete and secure against quantum attacks. Unlike Blazy et al.'s CBBS scheme which is based on a zero-knowledge protocol with cheating probability |$2/3$|⁠ , our CBBS scheme is based on a zero-knowledge protocol with cheating probability |$1/2$|⁠. The lower cheating probability would reduce the interaction rounds under the same security level and thus leads to a higher efficiency. For example, to achieve security level |$2^{-82}$|⁠ , the signature size in our CBBS scheme is |$1.63$| MB compared to |$3.1$| MB in Blazy et al.'s scheme. [ABSTRACT FROM AUTHOR]

Biometric-based authentication methods have been widely used, for example on portable devices (e.g., Android and iOS devices). However, there are several known limitations in existing authentication methods based on biometrics (e.g., those using facial, iris, and fingerprint). For example, in a healthcare context, a user may be physically incapable of completing the authentication due to his/her medical conditions. Hence, as a complementary authentication mechanism, there have been attempts to also utilize electrocardiogram (ECG). In this work, we propose an ECG authentication system that leverages deep learning. Specifically, to achieve generalization ability, complementary ensemble empirical decomposition (CEEMD) is introduced in our design. Moreover, a 1-D Multi-scale Convolutional Neural Network (1-D MCNN) is implemented to achieve accurate authentication. To evaluate the usability of our proposed approach, we have performed extensive experiments on eight databases, and the findings show that our proposed approach achieves good performance even on abnormal databases and can be adapted for different application environments. In addition, our adopted data from eight public databases requires theoretical statistical treatment for practical applications in real authentication scenarios. [ABSTRACT FROM AUTHOR]

The eight articles in this special section are dedicated to exploring the importance of network forensics and surveillance for network monitoring and attack mitigation, as well as the identification of state-ofthe-art advances in network forensics and surveillance. [ABSTRACT FROM AUTHOR]

The need to efficiently store and query large scale graph datasets is evident in the growing number of data-intensive applications, particularly to maximize the mining of intelligence from these data (e.g., to inform decision making). However, directly releasing graph dataset for analysis may leak sensitive information of an individual even if the graph is anonymized, as demonstrated by the re-identification attacks on the DBpedia datasets. A key challenge in the design of graph sanitization methods is scalability, as existing execution models generally have significant memory requirements. In this paper, we propose a novel k-decomposition algorithm and define a new information loss matrix designed for utility measurement in massively large graph datasets. We also propose a novel privacy preserving framework that can be seamlessly integrated with graph storage, anonymization, query processing, and analysis. Our experimental studies show that the proposed solution achieves privacy-preserving, utility, and efficiency. [ABSTRACT FROM AUTHOR]

The challenges of cloud forensics have been well-documented by both researchers and government agencies (e.g., U.S. National Institute of Standards and Technology), although many of the challenges remain unresolved. In this article, we perform a comprehensive survey of cloud forensic literature published between January 2007 and December 2018, categorized using a five-step forensic investigation process. We also present a taxonomy of existing cloud forensic solutions, with the aim of better informing both the research and practitioner communities, as well as an in-depth discussion of existing conventional digital forensic tools and cloud-specific forensic investigation tools. Based on the findings from the survey, we present a set of design guidelines to inform future cloud forensic investigation processes, and a summary of digital artifacts that can be obtained from different stakeholders in the cloud computing architecture/ecosystem. [ABSTRACT FROM AUTHOR]

Statistics such as k th minimum value play a crucial role in our data-driven society, for example by informing decision-making. In this paper, we propose an efficient privacy-preserving protocol that allows a group of users who do not trust each other, for example in a peer-to-peer (P2P) network, to jointly calculate the k th minimum value. Specifically, in our proposed protocol each user's data is converted to a binary bit string following a certain rule. Then, the bits at the same position are aggregated from the leftmost to the rightmost. As far as we know, this is the first published scheme to obtain k th minimum value in a P2P network without affecting users' privacy. We also remark that the proposed protocol can be easily generalized to compute other statistics, such as maximum value, minimum value, and median value, while achieving high efficiency in a privacy-preserving P2P network. We then demonstrate that the proposed protocol achieves forward security and is resilient to a range of external and internal attacks. [ABSTRACT FROM AUTHOR]

Mobile devices, such as Android and iOS devices, are an attractive target for cyber-criminals, due to the amount of private data that can be accessed or stored on such devices. As public charging facilities become more commonplace, phone charging attacks are no longer fiction. Juice filming charging (JFC) attack is a particular phone charging threat, which can capture or infer users' private information by automatically recording screen information from mobile devices during the entire charging process. In this work, we first investigate the types of phone applications users would interact with the most when charging their devices. Then, we propose a detection approach for JFC attacks solely by analyzing CPU usage. In the evaluation, we collect data from a total of 187 participants, and the findings show that our approach using the SVM classifier can achieve better performance than other approaches. Our work complements existing security mechanisms against charging threats. [ABSTRACT FROM AUTHOR]

There has been a trend of moving from simply de-identification to providing extended data control to their owner (e.g., data portability and right to be forgotten), partly due to the introduction of the General Data Protection Regulation (GDPR). Hence, in this paper, we survey the literature to provide an in-depth understanding of the existing approaches for personal data control (e.g., we observe that most existing approaches are generally designed to facilitate compliance), as well as the privacy regulations in Europe, United Kingdom, California, South Korea, and Japan. Based on the review, we identify the associated technical requirements, as well as a number of research gaps and potential future directions (e.g., the need for transparent processing of personal data and establishment of clear procedure in ensuring personal data control). [ABSTRACT FROM AUTHOR]

Abstract Large-scale virtualized data centers are increasingly becoming the norm in our data-intensive society. One pressing challenge is to reduce energy consumption in such data centers for edge computing deployment, which would have flow-on effects on reducing the operating costs and carbon dioxide emissions. Dynamic virtual machine consolidation is an effective way to improve resource utilization and energy efficiency. In this paper, a comprehensive strategy is proposed, which is based on time-series forecasting approach. In this strategy, specific adjustment of threshold is applied to adapt the dynamic workload. We then use a real-world dataset (i.e. workload trace in Google) for evaluation, whose findings demonstrate that our strategy outperforms other benchmarks. Highlights • Energy and performance efficient virtual machine consolidation. • Improve resource utilization and energy efficiency. • Real-world dataset (i.e. workload trace in Google) for evaluation. • High-performance computing in edge computing networks. [ABSTRACT FROM AUTHOR]

Abstract: Communication apps can be an important source of evidence in a forensic investigation (e.g., in the investigation of a drug trafficking or terrorism case where the communications apps were used by the accused persons during the transactions or planning activities). This study presents the first evidence‐based forensic taxonomy of Windows Phone communication apps, using an existing two‐dimensional Android forensic taxonomy as a baseline. Specifically, 30 Windows Phone communication apps, including Instant Messaging (IM) and Voice over IP (VoIP) apps, are examined. Artifacts extracted using physical acquisition are analyzed, and seven digital evidence objects of forensic interest are identified, namely: Call Log, Chats, Contacts, Locations, Installed Applications, SMSs and User Accounts. Findings from this study would help to facilitate timely and effective forensic investigations involving Windows Phone communication apps. [ABSTRACT FROM AUTHOR]

While designing ring signature and group signature is a relatively mature area, few published schemes are both efficient and quantum attack-resilience. In this paper, we present two new signature schemes based on coding theory. First, we present two new zero-knowledge (ZK) identification protocols based on the construction of (Cayrel, P.L., Véron, P. and Alaoui, S.M.E.Y. (2010) A Zero-Knowledge Identification Scheme Based on the q-ary Syndrome Decoding Problem. Proceedings of SAC 2010, Waterloo, Ontario, Canada, August 12-13, pp. 171-186. Springer, Berlin) in order to improve efficiency of code-based digital signature schemes. We then transform the newly proposed ZK protocols into a ring signature scheme and a group signature scheme. Our schemes enjoy a significant improvement in efficiency since reducing the cheating probability decreases the interaction rounds. Specially, with the security level of 2-87, the sizes of public key and signature are 14.5 KB and 52 KB in our ring signature scheme, while the corresponding sizes are 400 KB and 2384 KB in the scheme of (Cayrel, P. L., Alaoui, S. M. E. Y., Hoffmann, G. and Véron, P. (2012) An improved threshold ring signature scheme based on error correcting codes. Proceedings of WAIFI 2012, Bochum, Germany, July 16-19, pp. 45-63. Springer, Berlin). At the security level of 2-80, the sizes of public key and signature are 32 KB and 113.8 KB in our group signature scheme, as compared with 2.5 MB and 20 MB in the scheme of (Alamélou, Q., Blazy, O., Cauchie, S. and Gaborit, P. (2017) A codebased group signature scheme. Des. Codes Cryptogr., 82, 469-493) and 642 KB and 114 KB in the scheme of (Ezerman, M.F., Lee, H.T., Ling, S., Nguyen, K. and Wang, H. (2015) A provably secure group signature scheme from code-based assumptions. Proc. ASIACRYPT 2015, Auckland, New Zealand, November 29-December 3, pp. 260-285. Springer, Berlin). [ABSTRACT FROM AUTHOR]

Recently, with the fast proliferation of smart phones, mobile phone has the powerful ability of not only communication but also computation. Human beings are not only data consumers, but data producer with their objective or subjective sensing needs. Mobile crowd sensing is an emerging computing paradigm that tasks everyday mobile devices to form participatory sensor networks. It allows the increasing number of mobile phone users to share local knowledge acquired by their sensor-enhanced devices. Social sensors, social sensor receiver platform, and mobile crowd sensing paradigm compose a process by which physical sensors present in mobile devices such as GPS are used to infer social relationships and human activities. In this survey, we review the mobile crowd sensing applications on social sensors based on social sensor receiver platform (e.g., Weibo and Twitter) from three categories: public security, smart city, and location based services. Most applications adopted in current works fit in one of these categories. Existing works on applications of mobile crowd sensing on social sensors are collected and studied. Some possible future directions of potential new application category are proposed and analyzed. [ABSTRACT FROM AUTHOR]

The increasing popularity and constant evolution of mobile technologies have resulted in an increased focus in mobile device and app security and forensics research. Banking apps appear to be an understudied topic, despite their popularity with consumers. In this paper, seven Android m-banking apps in Thailand are analysed. Based on the findings of our study, we describe the forensic artefacts that could be forensically recovered from the apps, and the findings of security assessment of the apps. For example, we found that several of the apps do not implement root device detection, do not encrypt user data, or it is possible to modify the apps and install repackaged apps. [ABSTRACT FROM AUTHOR]

The capability to efficiently revoke compromised/misbehaving users is important in identity-based encryption (IBE) applications, as it is not a matter of if but of when that one or more users are compromised. Existing solutions generally require a trusted third party to update the private keys of nonrevoked users periodically, which impact on scalability and result in high computation and communication overheads at the key generation center. Li et al proposed a revocable IBE scheme, which outsources most of the computation and communication overheads to a Key Update Cloud Service Provider (KU-CSP). However, their scheme is lack of scalability since the KU-CSP must maintain a secret value for each user. Tseng et al proposed another revocable IBE scheme with a cloud revocation authority, seeking to provide scalability and improve both performance and security level. In this paper, we present a new revocable IBE scheme with a cloud revocation server (CRS). The CRS holds only one secret time update key for all users, which provides the capability to scale our scheme. We demonstrate that our scheme is secure against adaptive-ID and chosen ciphertext attacks under the k-CAA assumption and outperforms both schemes mentioned above, in terms of having lower computation and communication overheads. [ABSTRACT FROM AUTHOR]

Internet of things (IoT) applications comprising thousands or millions of intelligent devices or things is fast becoming a norm in our inter-connected world, and the significant amount of data generated from IoT applications is often stored in the cloud. However, searching encrypted data (i.e. Searchable Encryption—SE) in the cloud remains an ongoing challenge. Existing SE protocols include searchable symmetric encryption (SSE) and public-key encryption with keyword search (PEKS). Limitations of SSE include complex and expensive key management and distribution, while PEKS suffer from inefficiency and are vulnerable to insider keyword guessing attacks (KGA). Besides, most protocols are insecure against file-injection attacks carried out by a malicious server. Thus, in this paper, we propose an efficient and secure searchable encryption protocol using the trapdoor permutation function (TPF). The protocol is designed for cloud-based IoT (also referred to as Cloud of Things – CoT) deployment, such as Cloud of Battlefield Things and Cloud of Military Things. Compared with other existing SE protocols, our proposed SE protocol incurs lower computation cost at the expense of a slightly higher storage cost (which is less of an issue, considering the decreasing costs of storage). We also prove that our protocol achieves inside KGA resilience, forward privacy, and file-injection attack resilience. [ABSTRACT FROM AUTHOR]

With recent trends in big data and cloud computing, data mining has also attracted considerable interest due to its potential to deal with distributed data in the cloud. However, existing data mining technologies may not be directly deployed as we need to avoid accidental privacy disclosure when data from different sources are mined. In this paper, we propose a secure and flexible cloud-assisted association rule mining over horizontally partitioned databases. Using the proposed scheme, data owners can provide their data and mine the association rules in the cloud flexibly, while being assured of minimal risks of privacy leakage. We then show that our proposed scheme achieves privacy-preserving mining of association rules, and provides resilience against collusion attacks. A comparative summary demonstrates that the proposed scheme is more efficient, in terms of computational costs, relative to several existing homomorphic-encryption-based schemes. [ABSTRACT FROM AUTHOR]

Vehicular fog computing extends the fog computing paradigm to conventional vehicular networks. This allows us to support more ubiquitous vehicles, achieve better communication efficiency, and address limitations in conventional vehicular networks in terms of latency, location awareness, and real-time response (typically required in smart traffic control, driving safety applications, entertainment services, and other applications). Such requirements are particularly important in adversarial environments (e.g., urban warfare and battlefields in the Internet of Battlefield Things involving military vehicles). However, there is no one widely accepted definition for vehicular fog computing and use cases. Thus, in this article, we formalize the vehicular fog computing architecture and present a typical use case in vehicular fog computing. Then we discuss several key security and forensic challenges and potential solutions. [ABSTRACT FROM PUBLISHER]

Digital forensic visualization is an understudied area despite its potential to achieve significant improvements in the efficiency of an investigation, criminal or civil. In this study, a three-stage forensic data storage and visualization life cycle is presented. The first stage is the decoding of data, which involves preparing both structured and unstructured data for storage. In the storage stage, data are stored within our proposed database schema designed for ensuring data integrity and speed of storage and retrieval. The final stage is the visualization of stored data in a manner that facilitates user interaction. These functionalities are implemented in a proof of concept to demonstrate the utility of the proposed life cycle. The proof of concept demonstrates the utility of the proposed approach for the storage and visualization of digital forensic data. [ABSTRACT FROM AUTHOR]

The widespread adoption of Android devices and their capability to access significant private and confidential information have resulted in these devices being targeted by malware developers. Existing Android malware analysis techniques can be broadly categorized into static and dynamic analysis. In this paper, we present two machine learning aided approaches for static analysis of Android malware. The first approach is based on permissions and the other is based on source code analysis utilizing a bag-of-words representation model. Our permission-based model is computationally inexpensive, and is implemented as the feature of OWASP Seraphimdroid Android app that can be obtained from Google Play Store. Our evaluations of both approaches indicate an F-score of 95.1% and F-measure of 89% for the source code-based classification and permission-based classification models, respectively. [ABSTRACT FROM AUTHOR]

Blockchain can be used to build a peer-to-peer, secure, and smart transaction system. As a horizontal technology that has changed several fields of industry, blockchain has tremendous potential to transform healthcare systems as well. In this article, a systematic review is conducted to critically evaluate 64 articles on blockchain-based healthcare systems, published between 2016 and January 2020 in 21 conferences, 33 journals, and ten online sources. The aim of this article is to answer three main questions. First, what are the applications of blockchain in the healthcare systems, and what are the structures and challenges of applying blockchain to a specific healthcare domain? Second, what are the technical, temporal, and spatial aspects of the currently developed blockchain applications for different healthcare domain? Third, what are the future research directions in designing and implementing blockchain-based healthcare systems? Statistical facts about the technical aspects of these 64 articles show that most of the proposed blockchain-based healthcare systems use private blockchain and Ethereum platforms; furthermore, the majority of the authors are affiliated with research institutions in the USA and China. We also discuss potential future research directions, e.g., integrating the blockchain in artificial intelligence based solutions, cloud-computing-based solutions, and parallel blockchain architecture. [ABSTRACT FROM AUTHOR]

The increasing use of smartphones and cloud storage apps allows users to access their data anywhere, anytime. Due to the potential of mobile devices being used and/or targeted by criminals, such devices are an important source of evidence in investigations of both cybercrime and traditional crimes, such as drug trafficking. In this paper, we study the MEGA cloud client app, an increasingly popular alternative to Google Drive, Dropbox and OneDrive, on both Android and iOS platforms. In our study, we identify a range of artefacts arising from user activities, such as login, uploading, downloading, deletion, and the sharing of files, which could be forensically recovered, as well as findings such as modification of files’ timestamps. Our findings contribute to an up-to-date understanding of cloud storage forensics. [ABSTRACT FROM AUTHOR]

Researchers envisioned Storage as a Service (StaaS) as an effective solution to the distributed management of digital data. Cooperative storage cloud forensic is relatively new and is an under-explored area of research. Using Symform as a case study, we seek to determine the data remnants from the use of cooperative cloud storage services. In particular, we consider both mobile devices and personal computers running various popular operating systems, namely Windows 8.1, Mac OS X Mavericks 10.9.5, Ubuntu 14.04.1 LTS, iOS 7.1.2, and Android KitKat 4.4.4. Potential artefacts recovered during the research include data relating to the installation and uninstallation of the cloud applications, log-in to and log-out from Symform account using the client application, file synchronization as well as their time stamp information. This research contributes to an in-depth understanding of the types of terrestrial artifacts that are likely to remain after the use of cooperative storage cloud on client devices. [ABSTRACT FROM AUTHOR]

In cognitive radio networks, physical layer security is a promising secure wireless communication solution against eavesdropping attacks. In this paper, we study the problems of physical layer security and energy efficiency through power control and relays’ cooperation, where both decode-and-forward and amplify-and-forward protocols are considered. We propose an one-leader one-follower Stackelberg (OLOFS) game model in the presence of multiple eavesdroppers, where optimal power allocation and pricing strategy can be determined to maximize the players’ utilities. We also present a best relay selection criterion for OLOFS game model in both perfect channel state information (CSI) and imperfect CSI scenarios, which maximizes the secrecy capacity of the network. A distributed learning algorithm, inspired by the stochastic learning automata, is then proposed to achieve the equilibrium of the proposed games. Finally, we derive closed-form intercept probability expressions of the direct transmission scheme and the proposed game model over Rayleigh fading channels in both decode-and-forward and amplify-and-forward protocols. Our simulations demonstrate that the proposed game model improves network energy efficiency and has an improved performance against eavesdropping attacks, in comparison to Nash equilibrium, rand, and direct transmission schemes. We can also reduce the intercept probability by choosing a different relaying protocol (decode-and-forward or amplify-and-forward), based on the characteristic of channels in the proposed model. [ABSTRACT FROM AUTHOR]

In legal cases, ensuring that members of the judiciary and juries have an appropriate understanding of the evidence being presented is integral to the delivery of justice. This pilot study uses a questionnaire-type survey, in Indonesia and Taiwan (Republic of China) to determine the utility of multimedia presentations as a training tool for educating Judiciary and Linguistic (representing educated laypersons) groups. Participants’ understanding of three digital forensic terms was compared; before and after watching videos on the corresponding topics. The findings suggested that 80% of the participants experienced improved comprehension of specific technical terms after watching the multimedia videos. However, improvement in comprehension from viewing the videos reduces with age (ρ = –0.189 with aPvalue of 0.033 at 95% level of confidence). The study also found that the features of the video (e.g. analogy) affect participant’s understanding. The findings suggested that multimedia presentations are an effective means of improving understanding of technical terminologies and concepts. [ABSTRACT FROM AUTHOR]

Cloud computing can be generally regarded as the technology enabler for Internet of Things (IoT). To ensure the most effective collection of evidence from cloud-enabled IoT infrastructure, it is vital for forensic practitioners to possess a contemporary understanding of the artefacts from different cloud services and applications. In this paper, we seek to determine the data remnants from the use of the newer BitTorrent Sync applications (version 2.x). Findings from our research using mobile and computer devices running Windows, Mac OS, Ubuntu, iOS, and Android devices suggested that artefacts relating to the installation, uninstallation, log-in, log-off, and file synchronisation could be recovered, which are potential sources of IoT forensics. We also extend the cloud forensics framework of Martini and Choo to provide a forensically sound investigation methodology for the newer BitTorrent Sync applications. [ABSTRACT FROM AUTHOR]