Towards Automation in Digital Investigations : Seeking Efficiency in Digital Forensics in Mobile and Cloud Environments

Cybercrime and related malicious activity in our increasingly digital world has become more prevalent and sophisticated, evading traditional security mechanisms. Digital forensics has been proposed to help investigate, understand and eventually mitigate such attacks. The practice of digital forensics, however, is still fraught with various challenges. Some of the most prominent of these challenges include the increasing amounts of data and the diversity of digital evidence sources appearing in digital investigations. Mobile devices and cloud infrastructures are an interesting specimen, as they inherently exhibit these challenging circumstances and are becoming more prevalent in digital investigations today. Additionally they embody further characteristics such as large volumes of data from multiple sources, dynamic sharing of resources, limited individual device capabilities and the presence of sensitive data. These combined set of circumstances make digital investigations in mobile and cloud environments particularly challenging. This is not aided by the fact that digital forensics today still involves manual, time consuming tasks within the processes of identifying evidence, performing evidence acquisition and correlating multiple diverse sources of evidence in the analysis phase. Furthermore, industry standard tools developed are largely evidence-oriented, have limited support for evidence integration and only automate certain precursory tasks, such as indexing and text searching. In this study, efficiency, in the form of reducing the time and human labour effort expended, is sought after in digital investigations in highly networked environments through the automation of certain activities in the digital forensic process. To this end requirements are outlined and an architecture designed for an automated system that performs digital forensics in highly networked mobile and cloud environments. Part of the remote evidence acquisition activity of this architecture is built and tested on several mobile devices in terms of speed and reliability. A method for integrating multiple diverse evidence sources in an automated manner, supporting correlation and automated reasoning is developed and tested. Finally the proposed architecture is reviewed and enhancements proposed in order to further automate the architecture by introducing decentralization particularly within the storage and processing functionality. This decentralization also improves machine to machine communication supporting several digital investigation processes enabled by the architecture through harnessing the properties of various peer-to-peer overlays. Remote evidence acquisition helps to improve the efficiency (time and effort involved) in digital investigations by removing the need for proximity to the evidence. Experiments show that a single TCP connection client-server paradigm does not offer the required scalability and reliability for remote evidence acquisition and that a multi-TCP connection paradigm is required. The automated integration, correlation and reasoning on multiple diverse evidence sources demonstrated in the experiments improves speed and reduces the human effort needed in the analysis phase by removing the need for time-consuming manual correlation. Finally, informed by published scientific literature, the proposed enhancements for further decentralizing the Live Evidence Information Aggregator (LEIA) architecture offer a platform for increased machine-to-machine communication thereby enabling automation and reducing the need for manual human intervention.

Long-Term Impacts of a Museum School Experience on Science Identity

Thesis (Master's)--University of Washington, 2016-06

Accounting for uncertainty in marine reserve design

Ecosystems and the species and communities within them are highly complex systems that defy predictions with any degree of certainty. Managing and conserving these systems in the face of uncertainty remains a daunting challenge, particularly with respect to developing networks of marine reserves. Here we review several modelling frameworks that explicitly acknowledge and incorporate uncertainty, and then use these methods to evaluate reserve spacing rules given increasing levels of uncertainty about larval dispersal distances. Our approach finds similar spacing rules as have been proposed elsewhere - roughly 20-200 km - but highlights several advantages provided by uncertainty modelling over more traditional approaches to developing these estimates. In particular, we argue that uncertainty modelling can allow for (1) an evaluation of the risk associated with any decision based on the assumed uncertainty; (2) a method for quantifying the costs and benefits of reducing uncertainty; and (3) a useful tool for communicating to stakeholders the challenges in managing highly uncertain systems. We also argue that incorporating rather than avoiding uncertainty will increase the chances of successfully achieving conservation and management goals.

Tradeoffs of different types of species occurrence data for use in systematic conservation planning

Data on the occurrence of species are widely used to inform the design of reserve networks. These data contain commission errors (when a species is mistakenly thought to be present) and omission errors (when a species is mistakenly thought to be absent), and the rates of the two types of error are inversely related. Point locality data can minimize commission errors, but those obtained from museum collections are generally sparse, suffer from substantial spatial bias and contain large omission errors. Geographic ranges generate large commission errors because they assume homogenous species distributions. Predicted distribution data make explicit inferences on species occurrence and their commission and omission errors depend on model structure, on the omission of variables that determine species distribution and on data resolution. Omission errors lead to identifying networks of areas for conservation action that are smaller than required and centred on known species occurrences, thus affecting the comprehensiveness, representativeness and efficiency of selected areas. Commission errors lead to selecting areas not relevant to conservation, thus affecting the representativeness and adequacy of reserve networks. Conservation plans should include an estimation of commission and omission errors in underlying species data and explicitly use this information to influence conservation planning outcomes.

The 'moving targets' training algorithm

A simple method for training the dynamical behavior of a neural network is derived. It is applicable to any training problem in discrete-time networks with arbitrary feedback. The method resembles back-propagation in that it is a least-squares, gradient-based optimization method, but the optimization is carried out in the hidden part of state space instead of weight space. A straightforward adaptation of this method to feedforward networks offers an alternative to training by conventional back-propagation. Computational results are presented for simple dynamical training problems, with varied success. The failures appear to arise when the method converges to a chaotic attractor. A patch-up for this problem is proposed. The patch-up involves a technique for implementing inequality constraints which may be of interest in its own right.

After ANT:an illustrative discussion of the implications for qualitative accounting case research

The main aim of this article is to shed some light on the way in which actor network theory (ANT) might contribute to case research in accounting. The paper will seek to explain some of the theoretical suppositions which are commonly associated with ANT and which have so far made little impact on the accounting literature. At the same time the accounting literature has shown a particular reluctance to engage with the central concept of ANT which Lee and Hassard characterise as the desire to bring together the "human and non-human, social and technical factors in the same analytical view". The article also features a discussion of a research project which used an approach giving emphasis to both humans and objects in order to understand how ``facts'' have come to be settled as they are. In taking such views into the research it is hoped to provide insight into both the detail of accounting as it is practised within organisations and the manner in which human actors and objects of technology may combine to constitute networks within organisations.

Design and analysis of distributed utility maximization algorithm for multihop wireless network with inaccurate feedback

Distributed network utility maximization (NUM) is receiving increasing interests for cross-layer optimization problems in multihop wireless networks. Traditional distributed NUM algorithms rely heavily on feedback information between different network elements, such as traffic sources and routers. Because of the distinct features of multihop wireless networks such as time-varying channels and dynamic network topology, the feedback information is usually inaccurate, which represents as a major obstacle for distributed NUM application to wireless networks. The questions to be answered include if distributed NUM algorithm can converge with inaccurate feedback and how to design effective distributed NUM algorithm for wireless networks. In this paper, we first use the infinitesimal perturbation analysis technique to provide an unbiased gradient estimation on the aggregate rate of traffic sources at the routers based on locally available information. On the basis of that, we propose a stochastic approximation algorithm to solve the distributed NUM problem with inaccurate feedback. We then prove that the proposed algorithm can converge to the optimum solution of distributed NUM with perfect feedback under certain conditions. The proposed algorithm is applied to the joint rate and media access control problem for wireless networks. Numerical results demonstrate the convergence of the proposed algorithm. © 2013 John Wiley & Sons, Ltd.

Supply network strategy:role and competence requirements

This paper presents an argument that it is possible for an organisation to manage networks, but understanding this involves consideration of what is meant by "managing". Based on prior research and data from a major longitudinal action research study in the health sector, the paper describes six network management roles: network structuring agent; co-ordinator; advisor; information broker; relationship broker; innovation sponsor. The necessary "assets" for effective performance of these roles are identified, in particular those relating to team competence. The findings enrich and significantly develop previous work on network management roles and activities, and their influencing factors. It is concluded that, given the specific nature of the networks studied, further research is required to evaluate the generalisability of the findings, though initial indications are promising.

Internet-based applications in the agri-food supply chain:a survey on the Greek canning sector

In the agri-food industry, Internet-based applications changed the way companies conduct business mainly by facilitating activities that were already taking place, rather by giving birth to virtual networks creation. Due to the specific characteristics of the sector, Internet's huge potential has not been fully exploited yet, still remaining a new communication tool. This paper aims at giving empirical insights regarding the use of Internet-based applications in the agri-food supply chain, by focusing on the Greek fruit canning sector. In particular, the paper identifies companies' perceptions regarding perceived benefits, constrained factors and motivation factors towards the use of Internet-based applications. Results indicate that companies recognise benefits arising from the use of Internet, however they still use traditional ways when communicating with their partners. Regarding transportation issues, while companies' overall satisfaction is rather moderate and differs significantly from the importance placed on a number of criteria, companies are still sceptical in using Electronic Transportation Marketplace. © 2004 Elsevier Ltd. All rights reserved.

Design and analysis of distributed utility maximization algorithm for multihop wireless network with inaccurate feedback

Distributed network utility maximization (NUM) is receiving increasing interests for cross-layer optimization problems in multihop wireless networks. Traditional distributed NUM algorithms rely heavily on feedback information between different network elements, such as traffic sources and routers. Because of the distinct features of multihop wireless networks such as time-varying channels and dynamic network topology, the feedback information is usually inaccurate, which represents as a major obstacle for distributed NUM application to wireless networks. The questions to be answered include if distributed NUM algorithm can converge with inaccurate feedback and how to design effective distributed NUM algorithm for wireless networks. In this paper, we first use the infinitesimal perturbation analysis technique to provide an unbiased gradient estimation on the aggregate rate of traffic sources at the routers based on locally available information. On the basis of that, we propose a stochastic approximation algorithm to solve the distributed NUM problem with inaccurate feedback. We then prove that the proposed algorithm can converge to the optimum solution of distributed NUM with perfect feedback under certain conditions. The proposed algorithm is applied to the joint rate and media access control problem for wireless networks. Numerical results demonstrate the convergence of the proposed algorithm. © 2013 John Wiley & Sons, Ltd.

Adaptive agents in changing environments, the role of modularity

We explored the role of modularity as a means to improve evolvability in populations of adaptive agents. We performed two sets of artificial life experiments. In the first, the adaptive agents were neural networks controlling the behavior of simulated garbage collecting robots, where modularity referred to the networks architectural organization and evolvability to the capacity of the population to adapt to environmental changes measured by the agents performance. In the second, the agents were programs that control the changes in network's synaptic weights (learning algorithms), the modules were emerged clusters of symbols with a well defined function and evolvability was measured through the level of symbol diversity across programs. We found that the presence of modularity (either imposed by construction or as an emergent property in a favorable environment) is strongly correlated to the presence of very fit agents adapting effectively to environmental changes. In the case of learning algorithms we also observed that character diversity and modularity are also strongly correlated quantities. © 2014 Springer Science+Business Media New York.

Application of support vector machines on the basis of the first Hungarian bankruptcy model

In our study we rely on a data mining procedure known as support vector machine (SVM) on the database of the first Hungarian bankruptcy model. The models constructed are then contrasted with the results of earlier bankruptcy models with the use of classification accuracy and the area under the ROC curve. In using the SVM technique, in addition to conventional kernel functions, we also examine the possibilities of applying the ANOVA kernel function and take a detailed look at data preparation tasks recommended in using the SVM method (handling of outliers). The results of the models assembled suggest that a significant improvement of classification accuracy can be achieved on the database of the first Hungarian bankruptcy model when using the SVM method as opposed to neural networks.

Middle -class immigrant identities: Dominican-Americans in South Florida

Identity studies of immigrants are complex because of multiple influences affecting identity reconstruction during immigration and acculturation: nationality, socio-cultural differences, occupations, education, spatial and geographic locations, age, gender, and personal attributes. Most immigrant identity studies deal with lower-income immigrants, who do not have the resources of middle- and upper-middle-class immigrants. South Florida is “home” to many middle-class immigrants, including Dominican-Americans. This dissertation interviewed sixty-six Dominican immigrants in South Florida, in order to determine their reconstructed identities after immigration/resettlement and to discover what influences contributed to these changes in identities. ^ The research design of this dissertation utilized an inductive, qualitative model, with the “grounded theory” method of data collection, categorization, and analysis. Participants were selected by a snowball sampling and interviewed with an informal questionnaire. Results were transcribed, categorized, tabulated, and analyzed for conclusions and theorization on immigrant identity. ^ The dissertation addressed numerous influences relating to identity reconstruction: the differing circumstances of immigration, the unique resources of middle- and higher-class immigrants, the nurturing environment of South Florida for immigrants with education and professional skills, and the boundary protection offered by suburban spaces. The interviewees displayed a wide range of age, length of residence in the United States, reasons for immigration, entry ports, settlement, relocations, occupations, and claimed identities. Identity was cross-tabulated with the various influences, as a means of invalidating certain influences and indicating possible trends. ^ The dissertation concluded that middle-class immigrant identities are diverse and multiple, as are the related influences. None of these immigrants had become totally assimilated, nor have they retained dual, non-overlapping attachments or frames of reference. Instead, many of the immigrants seemed to have developed or negotiated two or more identities, according to need, context, and personal interest. A cosmopolitan community such as South Florida seems to have encouraged such multiplicity of identity. However, rather than forming free-flowing identities, most of these immigrants eventually developed diverse and hybrid identities that have bounded attachments to various networks, groups, and places in South Florida. ^

Analysis of fractured terrain using remote sensing and geographic information systems : establishing a correlation between fracture network properties and vegetation

This research analyzed the spatial relationship between a mega-scale fracture network and the occurrence of vegetation in an arid region. High-resolution aerial photographs of Arches National Park, Utah were used for digital image processing. Four sets of large-scale joints were digitized from the rectified color photograph in order to characterize the geospatial properties of the fracture network with the aid of a Geographic Information System. An unsupervised landcover classification was carried out to identify the spatial distribution of vegetation on the fractured outcrop. Results of this study confirm that the WNW-ESE alignment of vegetation is dominantly controlled by the spatial distribution of the systematic joint set, which in turn parallels the regional fold axis. This research provides insight into the spatial heterogeneity inherent to fracture networks, as well as the effects of jointing on the distribution of surface vegetation in desert environments.

Ferramenta para avaliação e inferência de parâmetros de redes industriais sem fio

Wireless sensor networks (WSN) have gained ground in the industrial environment, due to the possibility of connecting points of information that were inaccessible to wired networks. However, there are several challenges in the implementation and acceptance of this technology in the industrial environment, one of them the guaranteed availability of information, which can be influenced by various parameters, such as path stability and power consumption of the field device. As such, in this work was developed a tool to evaluate and infer parameters of wireless industrial networks based on the WirelessHART and ISA 100.11a protocols. The tool allows quantitative evaluation, qualitative evaluation and evaluation by inference during a given time of the operating network. The quantitative and qualitative evaluation are based on own definitions of parameters, such as the parameter of stability, or based on descriptive statistics, such as mean, standard deviation and box plots. In the evaluation by inference uses the intelligent technique artificial neural networks to infer some network parameters such as battery life. Finally, it displays the results of use the tool in different scenarios networks, as topologies star and mesh, in order to attest to the importance of tool in evaluation of the behavior of these networks, but also support possible changes or maintenance of the system.