Computer profiling for forensic purposes

Computer forensics is the process of gathering and analysing evidence from computer systems to aid in the investigation of a crime. Typically, such investigations are undertaken by human forensic examiners using purpose-built software to discover evidence from a computer disk. This process is a manual one, and the time it takes for a forensic examiner to conduct such an investigation is proportional to the storage capacity of the computer's disk drives. The heterogeneity and complexity of various data formats stored on modern computer systems compounds the problems posed by the sheer volume of data. The decision to undertake a computer forensic examination of a computer system is a decision to commit significant quantities of a human examiner's time. Where there is no prior knowledge of the information contained on a computer system, this commitment of time and energy occurs with little idea of the potential benefit to the investigation. The key contribution of this research is the design and development of an automated process to describe a computer system and its activity for the purposes of a computer forensic investigation. The term proposed for this process is computer profiling. A model of a computer system and its activity has been developed over the course of this research. Using this model a computer system, which is the subj ect of investigation, can be automatically described in terms useful to a forensic investigator. The computer profiling process IS resilient to attempts to disguise malicious computer activity. This resilience is achieved by detecting inconsistencies in the information used to infer the apparent activity of the computer. The practicality of the computer profiling process has been demonstrated by a proof-of concept software implementation. The model and the prototype implementation utilising the model were tested with data from real computer systems. The resilience of the process to attempts to disguise malicious activity has also been demonstrated with practical experiments conducted with the same prototype software implementation.

A model for computer profiling

This paper discusses the use of models in automatic computer forensic analysis, and proposes and elaborates on a novel model for use in computer profiling, the computer profiling object model. The computer profiling object model is an information model which models a computer as objects with various attributes and inter-relationships. These together provide the information necessary for a human investigator or an automated reasoning engine to make judgements as to the probable usage and evidentiary value of a computer system. The computer profiling object model can be implemented so as to support automated analysis to provide an investigator with the information needed to decide whether manual analysis is required.

Dealing with temporal inconsistency in automated computer forensic profiling

Computer profiling is the automated forensic examination of a computer system in order to provide a human investigator with a characterisation of the activities that have taken place on that system. As part of this process, the logical components of the computer system – components such as users, files and applications - are enumerated and the relationships between them discovered and reported. This information is enriched with traces of historical activity drawn from system logs and from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work examines the impact of temporal inconsistency in such information and discusses two types of temporal inconsistency that may arise – inconsistency arising out of the normal errant behaviour of a computer system, and inconsistency arising out of deliberate tampering by a suspect – and techniques for dealing with inconsistencies of the latter kind. We examine the impact of deliberate tampering through experiments conducted with prototype computer profiling software. Based on the results of these experiments, we discuss techniques which can be employed in computer profiling to deal with such temporal inconsistencies.

Conifer defence against insects: microarray gene expression profiling of Sitka spruce (Picea sitchensis) induced by mechanical wounding or feeding by spruce budworms (Choristoneura occidentalis) or white pine weevils (Pissodes strobi) reveals large

Conifers are resistant to attack from a large number of potential herbivores or pathogens. Previous molecular and biochemical characterization of selected conifer defence systems support a model of multigenic, constitutive and induced defences that act on invading insects via physical, chemical, biochemical or ecological (multitrophic) mechanisms. However, the genomic foundation of the complex defence and resistance mechanisms of conifers is largely unknown. As part of a genomics strategy to characterize inducible defences and possible resistance mechanisms of conifers against insect herbivory, we developed a cDNA microarray building upon a new spruce (Picea spp.) expressed sequence tag resource. This first-generation spruce cDNA microarray contains 9720 cDNA elements representing c. 5500 unique genes. We used this array to monitor gene expression in Sitka spruce (Picea sitchensis) bark in response to herbivory by white pine weevils (Pissodes strobi, Curculionidae) or wounding, and in young shoot tips in response to western spruce budworm (Choristoneura occidentalis, Lepidopterae) feeding. Weevils are stem-boring insects that feed on phloem, while budworms are foliage feeding larvae that consume needles and young shoot tips. Both insect species and wounding treatment caused substantial changes of the host plant transcriptome detected in each case by differential gene expression of several thousand array elements at 1 or 2 d after the onset of treatment. Overall, there was considerable overlap among differentially expressed gene sets from these three stress treatments. Functional classification of the induced transcripts revealed genes with roles in general plant defence, octadecanoid and ethylene signalling, transport, secondary metabolism, and transcriptional regulation. Several genes involved in primary metabolic processes such as photosynthesis were down-regulated upon insect feeding or wounding, fitting with the concept of dynamic resource allocation in plant defence. Refined expression analysis using gene-specific primers and real-time PCR for selected transcripts was in agreement with microarray results for most genes tested. This study provides the first large-scale survey of insect-induced defence transcripts in a gymnosperm and provides a platform for functional investigation of plant-insect interactions in spruce. Induction of spruce genes of octadecanoid and ethylene signalling, terpenoid biosynthesis, and phenolic secondary metabolism are discussed in more detail.

Profiling HRM in innovative firms

Effective people management is essential to successful innovation, however no single human resource function or practice can facilitate the development of innovation capacity in an organization. Several studies have argued that different bundles or configurations of human resource practices can improve innovation performance, but there is little empirically based research that provides details of the practices utilized by different types of innovative firms. In this exploratory, qualitative study of innovative Danish firms we examine the profiles of human resource practices evident in a sample of firms recognized for their innovative performance. In examining these profiles, we analyze how characteristics of the organizations, namely their size and the nature of industry specific core capabilities, influence the human resource practices used to support innovation. Our initial findings indicate that in this sample of firms size is not a factor but knowledge-intensive firms have notably different profiles of human resource practices to technology-based firms.

Interaction, privacy and profiling considerations in local mobile social software : a prototype agile ride share system

Agile ridesharing aims to utilise the capability of social networks and mobile phones to facilitate people to share vehicles and travel in real time. However the application of social networking technologies in local communities to address issues of personal transport faces significant design challenges. In this paper we describe an iterative design-based approach to exploring this problem and discuss findings from the use of an early prototype. The findings focus upon interaction, privacy and profiling. Our early results suggest that explicitly entering information such as ride data and personal profile data into formal fields for explicit computation of matches, as is done in many systems, may not be the best strategy. It might be preferable to support informal communication and negotiation with text search techniques.

Profiling the offence patterns of disqualified drink drivers in Queensland, Australia.

While unlicensed driving does not play a direct causative role in road crashes, it represents a major problem for road safety. A particular subgroup of concern is those offenders who continue to drive after having their licence disqualified for drink driving. Surveys of disqualified drivers suggest that driving among this group is relatively common. Method This paper reports findings from an analysis of the driving records of over 545,000 Queensland drivers who experienced a licence sanction between January 2003 and December 2008. The sample included drivers who were disqualified by a court (e.g., for drink driving); those who licence had been suspended administratively (e.g., for accumulation of demerit points); and those who were placed on a restricted licence. Results Overall, 95,461 of the drivers in the sample were disqualified from driving for a drink driving offence. During the period, these drivers were issued with a total of 2,644,619 traffic infringements with approximately 12% (n = 8, 095) convicted of a further drink driving offence while disqualified. Other traffic offences detected during this period including unlicensed driving (18%), driving an unregistered vehicle (27%), speeding (21%), dangerous driving (36%), mobile phone use (35%), non-restraint use (32%), and other moving violation (23%). Offending behaviour was more common among men than women. Conclusions While licence disqualification has previously been shown to be a relatively effective sanction for managing the behaviour of drink driving offenders, the results of the current study highlight that it is a far from perfect tool since many offenders continue to commit both drink driving and other traffic offences while disqualified. As such, this study highlights the ongoing need to enhance the detection of disqualified and unlicensed driving in order to deter this behaviour.

Profiling outdoor leadership

This paper examines the role outdoor recreation and education plays in the development of generic leaders who have a positive relationship to the natural world. Three questionnaires (Multifactor Leadership Questionnaire - MLQ; the New Ecological Paradigm Scale - NEP; and the Connectedness to Nature Scale - CNS) were administered online to 104 international outdoor leaders through five online networks. The three instruments assessed the nexus of transformational leadership theory and outdoor leadership. A descriptive analysis of early findings from the project are outlined in this paper. The results can be viewed as an appropriate platform for understanding outdoor recreation and education leaders’ ecological perspectives and the generic, transformational leadership skills.

User profiling based on folksonomy information in Web 2.0 for personalized recommender systems

Information overload has become a serious issue for web users. Personalisation can provide effective solutions to overcome this problem. Recommender systems are one popular personalisation tool to help users deal with this issue. As the base of personalisation, the accuracy and efficiency of web user profiling affects the performances of recommender systems and other personalisation systems greatly. In Web 2.0, the emerging user information provides new possible solutions to profile users. Folksonomy or tag information is a kind of typical Web 2.0 information. Folksonomy implies the users‘ topic interests and opinion information. It becomes another source of important user information to profile users and to make recommendations. However, since tags are arbitrary words given by users, folksonomy contains a lot of noise such as tag synonyms, semantic ambiguities and personal tags. Such noise makes it difficult to profile users accurately or to make quality recommendations. This thesis investigates the distinctive features and multiple relationships of folksonomy and explores novel approaches to solve the tag quality problem and profile users accurately. Harvesting the wisdom of crowds and experts, three new user profiling approaches are proposed: folksonomy based user profiling approach, taxonomy based user profiling approach, hybrid user profiling approach based on folksonomy and taxonomy. The proposed user profiling approaches are applied to recommender systems to improve their performances. Based on the generated user profiles, the user and item based collaborative filtering approaches, combined with the content filtering methods, are proposed to make recommendations. The proposed new user profiling and recommendation approaches have been evaluated through extensive experiments. The effectiveness evaluation experiments were conducted on two real world datasets collected from Amazon.com and CiteULike websites. The experimental results demonstrate that the proposed user profiling and recommendation approaches outperform those related state-of-the-art approaches. In addition, this thesis proposes a parallel, scalable user profiling implementation approach based on advanced cloud computing techniques such as Hadoop, MapReduce and Cascading. The scalability evaluation experiments were conducted on a large scaled dataset collected from Del.icio.us website. This thesis contributes to effectively use the wisdom of crowds and expert to help users solve information overload issues through providing more accurate, effective and efficient user profiling and recommendation approaches. It also contributes to better usages of taxonomy information given by experts and folksonomy information contributed by users in Web 2.0.

Parallel user profiling based on folksonomy for Large Scaled Recommender Systems : an implimentation of Cascading MapReduce

The Large scaled emerging user created information in web 2.0 such as tags, reviews, comments and blogs can be used to profile users’ interests and preferences to make personalized recommendations. To solve the scalability problem of the current user profiling and recommender systems, this paper proposes a parallel user profiling approach and a scalable recommender system. The current advanced cloud computing techniques including Hadoop, MapReduce and Cascading are employed to implement the proposed approaches. The experiments were conducted on Amazon EC2 Elastic MapReduce and S3 with a real world large scaled dataset from Del.icio.us website.

Profiling off-road motorcycle and all-terrain riders in Queensland, Australia

The current research aimed to profile off-road riders to identify specific sub-groups in relation to their risk-related behaviours and perceptions. A total of 235 adults from the Australian state of Queensland who had ridden a motorcycle or ATV off-road in the last 12 months were recruited. A cluster analysis was applied to the survey data. Two distinct clusters of riders were identified, which corresponded with the self-report of injury from an off-road riding crash in the prior 12 months. The injured cluster had a significantly higher mean risk propensity and use of safety equipment, though did not differ on self-reported risk taking. The injured cluster as a whole included a higher percentage of males, was younger, and rode more often for recreational or competitive purposes than the non-crash involved cluster. The results indicate that the crash cluster may be both more aware of the potential risks of riding and more willing to ride in a riskier manner.