Towards Automation in Digital Investigations : Seeking Efficiency in Digital Forensics in Mobile and Cloud Environments

Cybercrime and related malicious activity in our increasingly digital world has become more prevalent and sophisticated, evading traditional security mechanisms. Digital forensics has been proposed to help investigate, understand and eventually mitigate such attacks. The practice of digital forensics, however, is still fraught with various challenges. Some of the most prominent of these challenges include the increasing amounts of data and the diversity of digital evidence sources appearing in digital investigations. Mobile devices and cloud infrastructures are an interesting specimen, as they inherently exhibit these challenging circumstances and are becoming more prevalent in digital investigations today. Additionally they embody further characteristics such as large volumes of data from multiple sources, dynamic sharing of resources, limited individual device capabilities and the presence of sensitive data. These combined set of circumstances make digital investigations in mobile and cloud environments particularly challenging. This is not aided by the fact that digital forensics today still involves manual, time consuming tasks within the processes of identifying evidence, performing evidence acquisition and correlating multiple diverse sources of evidence in the analysis phase. Furthermore, industry standard tools developed are largely evidence-oriented, have limited support for evidence integration and only automate certain precursory tasks, such as indexing and text searching. In this study, efficiency, in the form of reducing the time and human labour effort expended, is sought after in digital investigations in highly networked environments through the automation of certain activities in the digital forensic process. To this end requirements are outlined and an architecture designed for an automated system that performs digital forensics in highly networked mobile and cloud environments. Part of the remote evidence acquisition activity of this architecture is built and tested on several mobile devices in terms of speed and reliability. A method for integrating multiple diverse evidence sources in an automated manner, supporting correlation and automated reasoning is developed and tested. Finally the proposed architecture is reviewed and enhancements proposed in order to further automate the architecture by introducing decentralization particularly within the storage and processing functionality. This decentralization also improves machine to machine communication supporting several digital investigation processes enabled by the architecture through harnessing the properties of various peer-to-peer overlays. Remote evidence acquisition helps to improve the efficiency (time and effort involved) in digital investigations by removing the need for proximity to the evidence. Experiments show that a single TCP connection client-server paradigm does not offer the required scalability and reliability for remote evidence acquisition and that a multi-TCP connection paradigm is required. The automated integration, correlation and reasoning on multiple diverse evidence sources demonstrated in the experiments improves speed and reduces the human effort needed in the analysis phase by removing the need for time-consuming manual correlation. Finally, informed by published scientific literature, the proposed enhancements for further decentralizing the Live Evidence Information Aggregator (LEIA) architecture offer a platform for increased machine-to-machine communication thereby enabling automation and reducing the need for manual human intervention.

Automaticity in L2 learning: Correlation between vocabulary proficiency and response time in word recognition

Automaticity (in this essay defined as short response time) and fluency in language use are closely connected to each other and some research has been conducted regarding some of the aspects involved. In fact, the notion of automaticity is still debated and many definitions and opinions on what automaticity is have been suggested (Andersson,1987, 1992, 1993, Logan, 1988, Segalowitz, 2010). One aspect that still needs more research is the correlation between vocabulary proficiency (a person’s knowledge about words and ability to use them correctly) and response time in word recognition. Therefore, the aim of this study has been to investigate this correlation using two different tests; one vocabulary size test (Paul Nation) and one lexical decision task (SuperLab) that measures both response time and accuracy. 23 Swedish students partaking in the English 7 course in upper secondary Swedish school were tested. The data were analyzed using a quantitative method where the average values and correlations from the test were used to compare the results. The correlations were calculated using Pearson’s Coefficient Correlations Calculator. The empirical study indicates that vocabulary proficiency is not strongly correlated with shorter response times in word recognition. Rather, the data indicate that L2 learners instead are sensitive to the frequency levels of the vocabulary. The accuracy (number of correct recognized words) and response times correlate with the frequency level of the tested words. This indicates that factors other than vocabulary proficiency are important for the ability to recognize words quickly.