The week's pick
Reseach Article
Fuzzy Crime Investigation Framework for Tracking Data Theft based on USB Storage
| International Journal of Computer Applications |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 84 - Number 10 |
| Year of Publication: 2013 |
| Authors: Ahmed M. Neil, Mohammed Elmogy, A. M. Riad |
10.5120/14615-2873
|
Ahmed M. Neil, Mohammed Elmogy, A. M. Riad . Fuzzy Crime Investigation Framework for Tracking Data Theft based on USB Storage. International Journal of Computer Applications. 84, 10 ( December 2013), 34-43. DOI=10.5120/14615-2873
Abstract
Since the lives of the persons are on the edge after being convicted in digital crimes. The main goal of digital forensics is to extract accurate evidence which determines whether the convict is guilty or not. The recent challenge is due to the big size of data that the investigator may deal with. These data stored in unnoticeable tiny devices such as USB sticks which may lead to a muddled decision because of the tediousness of the investigation. Fortunately, in Windows Operating systems, all users' transactions are stored in a central point which is known as Windows Registry. It stores all hardware and software configurations, user activities, and transactions. Therefore, digital forensics based on Windows registry is considered as a hot research field. This paper presents a proposed framework for digital crime investigation based on Fuzzy logic. It helps the investigator in the decision making phase about the evidence. This deals with the extracted evidence from relevant Windows Registry keys. Also, tracking the usage of USB devices for data theft was presented. Finally the proposed framework was tested on a simulated case study.
References
- Victor Chileshe Luo (2007), 'Tracing USB Device artifacts on Windows XP operating system for forensic purpose', in Australian Digital Forensics Conference, ed. , Edith Cowan University, 1-10.
- Mathieu Gorge: USB and other portable storage device usage: Be aware of the risks to your corporate data in order to take pre-emptive and/or corrective action, Elsevier Vol 2005(Issue 8), Pages 15-17, (2005)
- Krishnun Sansurooah : A forensics overview and analysis of USB flash memory devices, in Australian Digital Forensics, Edith Cowan University, Perth Western Australia, 99-108, (2009. )
- Marcel Breeuwsma, Martien de Jongh, Coert Klaver, Ronald van der Knijff and Mark Roeloffs 'Forensic Data Recovery from Flash Memory', SMALL SCALE DIGITAL DEVICE FORENSICS JOURNAL , Vol. 1, No. (1), pp: 1-17, (2007)
- Yang Yu, and Tzi-cker Chiueh: Display-Only File Server: A Solution against Information Theft Due to Insider Attack. ', 1-9, (2004)
- KevinHillstrom, HillstromLaurie Collier: Encyclopedia of Small Business? MageeD. Moniqueed. ?Farmington Hills, MI, USA?Gale Group/Thomson Learning?THIRD EDITION? Vol. 1& 2?pp:1-1230, 2007
- Grier Jonathan: Detecting data theft using stochastic forensics, Digital Investigation, Vol. 8. – pp: 71-77, 2011
- Yuandong Zhu, Pavel Gladyshev, and Joshua James 'Using shellbag information to reconstruct user activities', Digital Investigation Vol. 6, pp: 69-77, (2009)
- Zhenhua Tang Hong Ding, Ming Xu, Jian Xu: Carving the Windows Registry Files Based on the Internal Structure', in The 1st international conferences on information science & engineering, ed. , The 1st international conferences on information science and engineering, pp: 4788- 4791, (2009)
- Salvatatro J. Stolfo, Eleazar Eskin, Katherine Heller, Shlomo Hershkop, Andrew Honig, and Krysta Svore :A Comparative Evaluation of Two Algorithms for Windows Registry Anomaly Detection, pp: 1-34. (2005)
- Youngsoo Kim, Dowon Hong: Windows Registry and Hiding Suspects' Secret in Registry, Technical report, Electronics Telecommunications Research Institute (ETRI)/Convergence Security Group, pp: 393 - 398, (2008)
- Ewa Huebnar ,and Frans Henskens :The Role of Operating system in Computer Forensics', Acm Sigops Operating Systems Vol. 42, No. ( 3), pp:1-3. (2008)
- Jolanta Thmassen: Forensics Analysis of Unallocated Spaces in windows Registry Hives', Master's thesis, University of Liver pool, pp:1-63 (2008)
- George J. Silowash, and Christopher King 'Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources', Technical report, Carnegie Mellon University, pp:1-17, (2013)
- Chad Steel: Windows Forensics the Field Guide for Corporate Computer Investigation, John wiley & sons, (2006)
- Peter Hipson. Mastering Windows XP Registry, SYBEX Inc. (2002)
- Abhijeet R. Patil: Forensic Analysis Of Windows XP Registry', Club Hack Magazine, Vol. 1, pp: 1-32, (Feb 2010)
- Jerry Honey Cutt : Microsoft Windows Registry Guide, Microsoft Press, (2005)
- Lih Wern Wong: Forensic Analysis of the Windows Registry, Technical report, School of Computer and Information Science, Edith Cowan University, pp. : 1-13, [http://www. forensicfocus. com/downloads/forensic-analysis-windows-registry. pdf ] last access in (26/6/2012)
- Derrick J. Farmer: A Forensic Analysis of the Windows Registry, Technical report, Champlain College Burlington, Vermont, pp: (1-17) [http://eptuners. com/forensics/contents/A_Forensic_Examination_of_the_Windows_Registry_DETAILED. pdf] last accessed in (28/2/2012),
- Haoyang Xie, Keyu Jiang, Xiaohong Yuan, and Hongbiao Zeng: Forensic Analysis of Windows Registry Against Intrusion', International Journal of Network Security & Its Applications (IJNSA) Vol. 4, No. 2, pp. 121-134, (2012. )
- Carvey Harlan: The Windows Registry as a forensic resource', Digital. Investigation Vol : 2 No. 3, pp: 201--205. (2005)
- Ashley Brinson, Abigail Robinson, and Marcus Rogers: A cyber forensics ontology: Creating a new approach to studying cyber forensics, Digital Investigation, El Sevier, pp: 37–43, (2006)
- Niandong Liao, Shengfeng Tian, and Tinghua Wang 'Network forensics based on fuzzy logic and expert system', Computer Communications, Vol. , 32, No. (17), pp: 1881 – 1892, (2009)
- Chung-Huang Yang, and Pei-Hua Yen: Fast Deployment of Computer Forensics with USBs, International Conference on Broadband, Wireless Computing, Communication and Applications, IEEE, 413-416. (2010)
- Tanushree Roy, and Aruna Jain: Windows Registry Forensics: An Imperative Step in Tracking Data Theft via USB Devices, (IJCSIT) International Journal of Computer Science and Information Technologies Vol. 3, pp: 4427- 4433, (2012)
- Michael Negnevitsky: Artificial Intelligence, A Guide to Intelligent Systems, Addison-Wesley, (2005).
- Kilian Stoffel, Paul Cotofrei, and Dong Han 'Fuzzy Methods for Forensic Data Analysis', IEEE International Conference of Soft Computing and Pattern Recognition, pp: 23-28, (2010)
- Franke, Katrin and Srihari, Sargur N. : Computational Forensics: An Overview, in 'Proceedings of the 2nd international workshop on Computational Forensics', Springer-Verlag, Berlin, Heidelberg, pp. 1—10, (2008)
- Ahmed M. Neil, Mohammed Elmogy, and A. M. RIAD: A Proposed Framework for Crime Investigation Based On Windows Registry Analysis, Journal of Engineering and Applied Science, Faculty of Engineering, Cairo University, Vol. 60, No. 1, February 2013.
Index Terms
Keywords