首页 > 最新文献

2012 IEEE International Workshop on Information Forensics and Security (WIFS)最新文献

英文 中文
Towards reproducible results in authentication based on physical non-cloneable functions: The forensic authentication microstructure optical set (FAMOS) 基于物理不可克隆功能的身份验证的可复制结果:法医身份验证显微结构光学集(FAMOS)
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412623
S. Voloshynovskiy, M. Diephuis, F. Beekhof, O. Koval, B. Keel
Nowadays, the field of physical object security based on surface microstructures lacks common and shared data for the development, testing and fair benchmarking of new identification and authentication technologies. To our knowledge, most published results are based on proprietary data that also often lacks the necessary size for statistically significant results and conclusions. Therefore, in this paper, we introduce the first publicly available documented database for the investigation of physical object authentication based on non-cloneable surface microstructure images. We have built an automatic system suitable for massive acquisition of microstructure images from flat surfaces under different light conditions and with different cameras. The samples are acquired several times, and resulting images are aligned, labelled and online available to the public for further investigation and benchmarking of new methods. In this paper, we present the statistical properties for the images originating from 5000 unique carton packages acquired 6 times each with two different cameras. Furthermore, we derive statistical authentication frameworks for the original, the random projected and binarized domains presented together with all empirical results.
目前,基于表面微结构的物理对象安全领域缺乏共同和共享的数据来开发、测试和公平地对标新的识别和认证技术。据我们所知,大多数已发表的结果都是基于专有数据,这些数据往往缺乏必要的规模来获得统计上显著的结果和结论。因此,在本文中,我们介绍了第一个公开可用的文档数据库,用于研究基于不可克隆表面微观结构图像的物理对象身份验证。我们建立了一个自动系统,适用于在不同光照条件和不同相机下从平面上大量采集微结构图像。样品被多次获取,得到的图像被对齐、标记并在线提供给公众,以供进一步调查和对新方法进行基准测试。在本文中,我们提出了来自5000个独特纸箱包装的图像的统计特性,每个包装用两个不同的相机获得6次。此外,我们推导了原始域、随机投影域和二值化域的统计认证框架以及所有的经验结果。
{"title":"Towards reproducible results in authentication based on physical non-cloneable functions: The forensic authentication microstructure optical set (FAMOS)","authors":"S. Voloshynovskiy, M. Diephuis, F. Beekhof, O. Koval, B. Keel","doi":"10.1109/WIFS.2012.6412623","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412623","url":null,"abstract":"Nowadays, the field of physical object security based on surface microstructures lacks common and shared data for the development, testing and fair benchmarking of new identification and authentication technologies. To our knowledge, most published results are based on proprietary data that also often lacks the necessary size for statistically significant results and conclusions. Therefore, in this paper, we introduce the first publicly available documented database for the investigation of physical object authentication based on non-cloneable surface microstructure images. We have built an automatic system suitable for massive acquisition of microstructure images from flat surfaces under different light conditions and with different cameras. The samples are acquired several times, and resulting images are aligned, labelled and online available to the public for further investigation and benchmarking of new methods. In this paper, we present the statistical properties for the images originating from 5000 unique carton packages acquired 6 times each with two different cameras. Furthermore, we derive statistical authentication frameworks for the original, the random projected and binarized domains presented together with all empirical results.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124994640","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 29
Novel fingerprint aging features using binary pixel sub-tendencies: A comparison of contactless CLSM and CWL sensors 基于二像素子趋势的新型指纹老化特征:非接触式CLSM和CWL传感器的比较
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412617
R. Merkel, J. Dittmann, C. Vielhauer
Age determination of latent fingerprints from crime scenes is an open challenge to forensic experts since several decades. In recent publications it was shown that a feature called binary pixel in combination with a contactless and non-invasive Chromatic White Light (CWL) image sensor is able to distinguish between fingerprints younger as or older than five hours with an accuracy of about 70-80%. Such approach can be seen as a very promising first step, but needs to be improved (e.g. by a fusion with additional aging features) to reach error rates that would be acceptable in legal proceedings. In the scope of this paper, two novel aging features are introduced and evaluated as opposing sub-tendencies of the classical binary pixel feature. Furthermore, Confocal Laser Scanning Microscopy (CLSM) is firstly applied to fingerprint aging evaluations. In our experiments, 200 fingerprint time series (captured every hour for 24 hours) for each the novel CLSM as well as the classical CWL device (9600 fingerprint images in total) are evaluated and compared using the classical binary pixel feature as well as both novel sub-tendency features. We show that one of such new sub-tendencies performs very well for the CLSM device (90% of curves show a strong logarithmic aging behavior), while for the CWL sensor the classical binary pixel feature performs best (87% of curves showing a strong logarithmic aging behavior). The increased performance of such new feature can be seen as very suitable for complementing the classical CWL binary pixel aging feature in a future age estimation approach.
几十年来,确定犯罪现场潜在指纹的年龄一直是法医专家面临的一个公开挑战。在最近的出版物中,一种被称为二元像素的特征与非接触式非侵入性彩色白光(CWL)图像传感器相结合,能够区分指纹年龄小于5小时或大于5小时,准确率约为70-80%。这种方法可以被视为非常有希望的第一步,但需要改进(例如,通过与额外的老化特征融合)以达到在法律程序中可以接受的错误率。在本文的范围内,引入了两种新的老化特征,并将其作为经典二值像素特征的对立子趋势进行了评价。此外,首次将激光共聚焦扫描显微技术应用于指纹老化评价。在我们的实验中,使用经典的二值像素特征和两种新型的子趋势特征,对每种新型CLSM和经典CWL设备(共9600张指纹图像)的200个指纹时间序列(每小时捕获一次,持续24小时)进行了评估和比较。研究表明,其中一种新的子趋势在CLSM器件中表现得非常好(90%的曲线表现出强烈的对数老化行为),而在CWL传感器中,经典的二值像素特征表现得最好(87%的曲线表现出强烈的对数老化行为)。这种新特征的性能提高可以被视为非常适合在未来的年龄估计方法中补充经典的CWL二进制像素老化特征。
{"title":"Novel fingerprint aging features using binary pixel sub-tendencies: A comparison of contactless CLSM and CWL sensors","authors":"R. Merkel, J. Dittmann, C. Vielhauer","doi":"10.1109/WIFS.2012.6412617","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412617","url":null,"abstract":"Age determination of latent fingerprints from crime scenes is an open challenge to forensic experts since several decades. In recent publications it was shown that a feature called binary pixel in combination with a contactless and non-invasive Chromatic White Light (CWL) image sensor is able to distinguish between fingerprints younger as or older than five hours with an accuracy of about 70-80%. Such approach can be seen as a very promising first step, but needs to be improved (e.g. by a fusion with additional aging features) to reach error rates that would be acceptable in legal proceedings. In the scope of this paper, two novel aging features are introduced and evaluated as opposing sub-tendencies of the classical binary pixel feature. Furthermore, Confocal Laser Scanning Microscopy (CLSM) is firstly applied to fingerprint aging evaluations. In our experiments, 200 fingerprint time series (captured every hour for 24 hours) for each the novel CLSM as well as the classical CWL device (9600 fingerprint images in total) are evaluated and compared using the classical binary pixel feature as well as both novel sub-tendency features. We show that one of such new sub-tendencies performs very well for the CLSM device (90% of curves show a strong logarithmic aging behavior), while for the CWL sensor the classical binary pixel feature performs best (87% of curves showing a strong logarithmic aging behavior). The increased performance of such new feature can be seen as very suitable for complementing the classical CWL binary pixel aging feature in a future age estimation approach.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125085682","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Privacy-preserving architecture for forensic image recognition 用于法医图像识别的隐私保护架构
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412629
Andreas Peter, Thomas Hartmann, Sascha Müller, S. Katzenbeisser
Forensic image recognition is an important tool in many areas of law enforcement where an agency wants to prosecute possessors of illegal images. The recognition of illegal images that might have undergone human imperceptible changes (e.g., a JPEG-recompression) is commonly done by computing a perceptual image hash function of a given image and then matching this hash with perceptual hash values in a database of previously collected illegal images. To prevent privacy violation, agencies should only learn about images that have been reliably detected as illegal and nothing else. In this work, we argue that the prevalent presence of separate departments in such agencies can be used to enforce the need-to-know principle by separating duties among them. This enables us to construct the first practically efficient architecture to perform forensic image recognition in a privacy-preserving manner. By deriving unique cryptographic keys directly from the images, we can encrypt all sensitive data and ensure that only illegal images can be recovered by the law enforcement agency while all other information remains protected.
在许多执法领域,当一个机构想要起诉非法图像的持有者时,法医图像识别是一个重要的工具。识别可能经历了人类难以察觉的变化的非法图像(例如,jpeg再压缩)通常是通过计算给定图像的感知图像哈希函数,然后将该哈希与先前收集的非法图像数据库中的感知哈希值进行匹配来完成的。为了防止侵犯隐私,机构应该只了解那些被可靠地检测为非法的图像,而不是其他图像。在这项工作中,我们认为,这些机构中普遍存在的独立部门可以通过分离它们之间的职责来执行需要知道的原则。这使我们能够以保护隐私的方式构建第一个实际有效的体系结构来执行法医图像识别。通过直接从图像中提取唯一的加密密钥,我们可以加密所有敏感数据,并确保执法机构只能恢复非法图像,而所有其他信息仍然受到保护。
{"title":"Privacy-preserving architecture for forensic image recognition","authors":"Andreas Peter, Thomas Hartmann, Sascha Müller, S. Katzenbeisser","doi":"10.1109/WIFS.2012.6412629","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412629","url":null,"abstract":"Forensic image recognition is an important tool in many areas of law enforcement where an agency wants to prosecute possessors of illegal images. The recognition of illegal images that might have undergone human imperceptible changes (e.g., a JPEG-recompression) is commonly done by computing a perceptual image hash function of a given image and then matching this hash with perceptual hash values in a database of previously collected illegal images. To prevent privacy violation, agencies should only learn about images that have been reliably detected as illegal and nothing else. In this work, we argue that the prevalent presence of separate departments in such agencies can be used to enforce the need-to-know principle by separating duties among them. This enables us to construct the first practically efficient architecture to perform forensic image recognition in a privacy-preserving manner. By deriving unique cryptographic keys directly from the images, we can encrypt all sensitive data and ensure that only illegal images can be recovered by the law enforcement agency while all other information remains protected.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115930675","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
Content authentication and identification under informed attacks 知情攻击下的内容认证与识别
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412638
F. Beekhof, S. Voloshynovskiy, F. Farhadzadeh
We consider the problem of content identification and authentication based on digital content fingerprinting. Contrary to existing work in which the performance of these systems under blind attacks is analysed, we investigate the information-theoretic performance under informed attacks. In the case of binary content fingerprinting, in a blind attack, a probe is produced at random independently from the fingerprints of the original contents. Contrarily, informed attacks assume that the attacker might have some information about the original content and is thus able to produce a counterfeit probe that is related to an authentic fingerprint corresponding to an original item, thus leading to an increased probability of false acceptance. We demonstrate the impact of the ability of an attacker to create counterfeit items whose fingerprints are related to fingerprints of authentic items, and consider the influence of the length of the fingerprint on the performance of finite-length systems. Finally, the information-theoretic achieveble rate of content identification systems sustaining informed attacks is derived under asymptotic assumptions about the fingerprint length.
研究了基于数字内容指纹的内容识别与认证问题。与分析这些系统在盲目攻击下的性能的现有工作相反,我们研究了在知情攻击下的信息论性能。在二进制内容指纹的情况下,在盲目攻击中,探针独立于原始内容的指纹随机产生。相反,知情攻击假定攻击者可能掌握了原始内容的一些信息,因此能够制造与原始物品对应的真实指纹相关的伪造探针,从而导致错误接受的可能性增加。我们演示了攻击者创建指纹与正品指纹相关的伪造物品的能力的影响,并考虑了指纹长度对有限长度系统性能的影响。最后,在关于指纹长度的渐近假设下,导出了内容识别系统承受知情攻击的信息理论可达率。
{"title":"Content authentication and identification under informed attacks","authors":"F. Beekhof, S. Voloshynovskiy, F. Farhadzadeh","doi":"10.1109/WIFS.2012.6412638","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412638","url":null,"abstract":"We consider the problem of content identification and authentication based on digital content fingerprinting. Contrary to existing work in which the performance of these systems under blind attacks is analysed, we investigate the information-theoretic performance under informed attacks. In the case of binary content fingerprinting, in a blind attack, a probe is produced at random independently from the fingerprints of the original contents. Contrarily, informed attacks assume that the attacker might have some information about the original content and is thus able to produce a counterfeit probe that is related to an authentic fingerprint corresponding to an original item, thus leading to an increased probability of false acceptance. We demonstrate the impact of the ability of an attacker to create counterfeit items whose fingerprints are related to fingerprints of authentic items, and consider the influence of the length of the fingerprint on the performance of finite-length systems. Finally, the information-theoretic achieveble rate of content identification systems sustaining informed attacks is derived under asymptotic assumptions about the fingerprint length.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134115997","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 15
Mapping evidence graphs to attack graphs 将证据图映射到攻击图
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412636
Changwei Liu, A. Singhal, D. Wijesekera
Attack graphs compute potential attack paths from a system configuration and known vulnerabilities of a system. Evidence graphs model intrusion evidence and dependencies among them. In this paper, we show how to map evidence graphs to attack graphs. This mapping is useful for application of attack graphs and evidence graphs for forensic analysis. In addition to helping to refine attack graphs by using known sets of dependent attack evidence, important probabilistic information contained in evidence graphs can be used to compute or refine potential attack success probabilities obtained from repositories like CVSS. Conversely, attack graphs can be used to add missing evidence or remove irrelevant evidence trails to build a complete evidence graph. We illustrated the mapping by using a database attack as a case study.
攻击图根据系统配置和系统的已知漏洞计算潜在的攻击路径。证据图对入侵证据及其相互依赖关系进行建模。在本文中,我们展示了如何将证据图映射到攻击图。这种映射对于攻击图和证据图在法医分析中的应用是有用的。除了通过使用已知的依赖攻击证据集来帮助改进攻击图之外,证据图中包含的重要概率信息可用于计算或改进从CVSS等存储库获得的潜在攻击成功概率。相反,攻击图可以用来添加缺失的证据或删除不相关的证据轨迹,以构建完整的证据图。我们通过使用数据库攻击作为案例研究来说明这种映射。
{"title":"Mapping evidence graphs to attack graphs","authors":"Changwei Liu, A. Singhal, D. Wijesekera","doi":"10.1109/WIFS.2012.6412636","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412636","url":null,"abstract":"Attack graphs compute potential attack paths from a system configuration and known vulnerabilities of a system. Evidence graphs model intrusion evidence and dependencies among them. In this paper, we show how to map evidence graphs to attack graphs. This mapping is useful for application of attack graphs and evidence graphs for forensic analysis. In addition to helping to refine attack graphs by using known sets of dependent attack evidence, important probabilistic information contained in evidence graphs can be used to compute or refine potential attack success probabilities obtained from repositories like CVSS. Conversely, attack graphs can be used to add missing evidence or remove irrelevant evidence trails to build a complete evidence graph. We illustrated the mapping by using a database attack as a case study.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133096676","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 26
End-to-end secure connection in heterogeneous networks for critical scenarios 关键场景异构网络端到端安全连接
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412660
R. Giuliano, A. Neri, Damiano Valletta
This contribution is focused on securing end-to-end unicast communications in heterogeneous sensor networks comprising satellite links, while maintaining effective network performance. The proposed protocol extends the LOCKSAT (LOCal Key Synchronization and generation for data security in sATellite communication) key management procedure, and is able to guarantee a frequent key renewal while overcoming limitations of both sensor and satellite segment. Effectiveness of the solution is assessed through a test bed including real and simulated satellite links.
这一贡献的重点是在包括卫星链路的异构传感器网络中保护端到端单播通信,同时保持有效的网络性能。该协议扩展了LOCKSAT (LOCal Key Synchronization and generation for data security in sATellite communication)密钥管理过程,能够在克服传感器和卫星段限制的同时保证密钥的频繁更新。通过包括真实和模拟卫星链路的试验台评估了该解决方案的有效性。
{"title":"End-to-end secure connection in heterogeneous networks for critical scenarios","authors":"R. Giuliano, A. Neri, Damiano Valletta","doi":"10.1109/WIFS.2012.6412660","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412660","url":null,"abstract":"This contribution is focused on securing end-to-end unicast communications in heterogeneous sensor networks comprising satellite links, while maintaining effective network performance. The proposed protocol extends the LOCKSAT (LOCal Key Synchronization and generation for data security in sATellite communication) key management procedure, and is able to guarantee a frequent key renewal while overcoming limitations of both sensor and satellite segment. Effectiveness of the solution is assessed through a test bed including real and simulated satellite links.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"54 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123480841","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Detecting fingerprint distortion from a single image 从单个图像检测指纹失真
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412616
Xuanbin Si, Jianjiang Feng, Jie Zhou
Elastic distortion of friction ridge skin is one of the major challenges in fingerprint matching. Since existing fingerprint matching systems cannot match seriously distorted fingerprints, criminals may purposely distort their fingerprints to evade identification. Existing distortion detection techniques require availability of specialized hardware or fingerprint video, limiting their use in real applications. In this paper we conduct a study on fingerprint distortion and develop an algorithm to detect fingerprint distortion from a single image which is captured using traditional fingerprint sensing techniques. The detector is based on analyzing ridge period and orientation information. Promising results are obtained on a public domain fingerprint database containing distorted fingerprints.
摩擦脊皮的弹性变形是指纹匹配中的主要问题之一。由于现有的指纹匹配系统无法匹配严重扭曲的指纹,犯罪分子可能会故意扭曲指纹以逃避识别。现有的失真检测技术需要专门的硬件或指纹视频,限制了它们在实际应用中的使用。本文对指纹失真进行了研究,并开发了一种从传统指纹传感技术捕获的单幅图像中检测指纹失真的算法。该探测器基于对脊周期和方位信息的分析。在包含扭曲指纹的公共领域指纹数据库上取得了令人满意的结果。
{"title":"Detecting fingerprint distortion from a single image","authors":"Xuanbin Si, Jianjiang Feng, Jie Zhou","doi":"10.1109/WIFS.2012.6412616","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412616","url":null,"abstract":"Elastic distortion of friction ridge skin is one of the major challenges in fingerprint matching. Since existing fingerprint matching systems cannot match seriously distorted fingerprints, criminals may purposely distort their fingerprints to evade identification. Existing distortion detection techniques require availability of specialized hardware or fingerprint video, limiting their use in real applications. In this paper we conduct a study on fingerprint distortion and develop an algorithm to detect fingerprint distortion from a single image which is captured using traditional fingerprint sensing techniques. The detector is based on analyzing ridge period and orientation information. Promising results are obtained on a public domain fingerprint database containing distorted fingerprints.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"130 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122879978","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 26
Forensic analysis of wireless networking evidence of Android smartphones Android智能手机无线网络证据的取证分析
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412634
Panagiotis Andriotis, G. Oikonomou, T. Tryfonas
This paper introduces a method for acquiring forensic-grade evidence from Android smartphones using open source tools. We investigate in particular cases where the suspect has made use of the smartphone's Wi-Fi or Bluetooth interfaces. We discuss the forensic analysis of four case studies, which revealed traces that were left in the inner structure of three mobile Android devices and also indicated security vulnerabilities. Subsequently, we propose a detailed plan for forensic examiners to follow when dealing with investigations of potential crimes committed using the wireless facilities of a suspect Android smartphone. This method can be followed to perform physical acquisition of data without using commercial tools and then to examine them safely in order to discover any activity associated with wireless communications. We evaluate our method using the Association of Chief Police Officers' (ACPO) guidelines of good practice for computer-based, electronic evidence and demonstrate that it is made up of an acceptable host of procedures for mobile forensic analysis, focused specifically on device Bluetooth and Wi-Fi facilities.
本文介绍了一种利用开源工具从Android智能手机获取法医级证据的方法。我们会在嫌疑人使用智能手机Wi-Fi或蓝牙接口的特殊情况下进行调查。我们讨论了四个案例研究的取证分析,它们揭示了在三个移动Android设备的内部结构中留下的痕迹,并指出了安全漏洞。随后,我们提出了一个详细的计划,供法医在处理使用可疑Android智能手机的无线设施进行的潜在犯罪调查时遵循。可以遵循此方法在不使用商业工具的情况下执行数据的物理获取,然后安全地检查它们,以便发现与无线通信相关的任何活动。我们使用首席警官协会(ACPO)关于基于计算机的电子证据的良好实践指南来评估我们的方法,并证明它由可接受的移动法医分析程序组成,特别关注设备蓝牙和Wi-Fi设施。
{"title":"Forensic analysis of wireless networking evidence of Android smartphones","authors":"Panagiotis Andriotis, G. Oikonomou, T. Tryfonas","doi":"10.1109/WIFS.2012.6412634","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412634","url":null,"abstract":"This paper introduces a method for acquiring forensic-grade evidence from Android smartphones using open source tools. We investigate in particular cases where the suspect has made use of the smartphone's Wi-Fi or Bluetooth interfaces. We discuss the forensic analysis of four case studies, which revealed traces that were left in the inner structure of three mobile Android devices and also indicated security vulnerabilities. Subsequently, we propose a detailed plan for forensic examiners to follow when dealing with investigations of potential crimes committed using the wireless facilities of a suspect Android smartphone. This method can be followed to perform physical acquisition of data without using commercial tools and then to examine them safely in order to discover any activity associated with wireless communications. We evaluate our method using the Association of Chief Police Officers' (ACPO) guidelines of good practice for computer-based, electronic evidence and demonstrate that it is made up of an acceptable host of procedures for mobile forensic analysis, focused specifically on device Bluetooth and Wi-Fi facilities.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"7 8","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120910542","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 40
Forensic analysis of ordered data structures on the example of JPEG files 以JPEG文件为例,对有序数据结构进行取证分析
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412639
Thomas Gloe
JPEG file format standards define only a limited number of mandatory data structures and leave room for interpretation. Differences between implementations employed in digital cameras, image processing software, and software to edit metadata provide valuable clues for basic authentication of digital images. We show that there exists a realistic chance to fool state-of-the-art image file forensic methods using available software tools and introduce the analysis of ordered data structures on the example of JPEG file formats and the EXIF metadata format as countermeasure. The proposed analysis approach enables basic investigations of image authenticity and documents a much better trustworthiness of EXIF metadata than commonly accepted. Manipulations created with the renowned metadata editor ExifTool and various image processing software can be reliably detected. Analysing the sequence of elements in complex data structures is not limited to JPEG files and might be a general principle applicable to different multimedia formats.
JPEG文件格式标准只定义了有限数量的强制数据结构,并留下了解释的空间。在数字相机、图像处理软件和编辑元数据软件中使用的实现之间的差异为数字图像的基本身份验证提供了有价值的线索。我们表明,使用可用的软件工具存在欺骗最先进的图像文件取证方法的现实机会,并以JPEG文件格式和EXIF元数据格式为例介绍了有序数据结构的分析作为对策。所提出的分析方法能够对图像真实性进行基本调查,并记录EXIF元数据比通常接受的可信度高得多的可信度。使用著名的元数据编辑器ExifTool和各种图像处理软件创建的操作可以可靠地检测到。分析复杂数据结构中的元素序列并不局限于JPEG文件,它可能是适用于不同多媒体格式的一般原则。
{"title":"Forensic analysis of ordered data structures on the example of JPEG files","authors":"Thomas Gloe","doi":"10.1109/WIFS.2012.6412639","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412639","url":null,"abstract":"JPEG file format standards define only a limited number of mandatory data structures and leave room for interpretation. Differences between implementations employed in digital cameras, image processing software, and software to edit metadata provide valuable clues for basic authentication of digital images. We show that there exists a realistic chance to fool state-of-the-art image file forensic methods using available software tools and introduce the analysis of ordered data structures on the example of JPEG file formats and the EXIF metadata format as countermeasure. The proposed analysis approach enables basic investigations of image authenticity and documents a much better trustworthiness of EXIF metadata than commonly accepted. Manipulations created with the renowned metadata editor ExifTool and various image processing software can be reliably detected. Analysing the sequence of elements in complex data structures is not limited to JPEG files and might be a general principle applicable to different multimedia formats.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121580707","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 37
Can a “poor” verification system be a “good” identification system? A preliminary study 一个“差”的验证系统能成为一个“好的”识别系统吗?初步研究
Pub Date : 2012-12-01 DOI: 10.1109/WIFS.2012.6412621
Brian DeCann, A. Ross
The matching accuracy of a biometric system is typically quantified through measures such as the False Match Rate (FMR), False Non-match Rate (FNMR), Equal Error Rate (EER), Receiver Operating Characteristic (ROC) curve and Cumulative Match Characteristic (CMC) curve. In this work, we analyze the relationship between the ROC and CMC curves, which are two measures commonly used to describe the performance of verification and identification systems, respectively. We establish that it is possible for a biometric system to exhibit “good” verification performance and “poor” identification performance (and vice versa) by demonstrating the conditions required to produce such outcomes. Experimental analysis using synthetically generated match scores confirms our hypothesis that the ROC or CMC alone cannot completely characterize biometric system performance.
生物识别系统的匹配精度通常通过诸如错误匹配率(FMR)、错误不匹配率(FNMR)、等错误率(EER)、接收者工作特征(ROC)曲线和累积匹配特征(CMC)曲线等测量来量化。在这项工作中,我们分析了ROC曲线和CMC曲线之间的关系,这两个曲线分别是常用来描述验证和识别系统性能的两个指标。我们通过演示产生此类结果所需的条件,确定生物识别系统有可能表现出“良好”的验证性能和“差”的识别性能(反之亦然)。使用合成匹配分数的实验分析证实了我们的假设,即ROC或CMC本身不能完全表征生物识别系统的性能。
{"title":"Can a “poor” verification system be a “good” identification system? A preliminary study","authors":"Brian DeCann, A. Ross","doi":"10.1109/WIFS.2012.6412621","DOIUrl":"https://doi.org/10.1109/WIFS.2012.6412621","url":null,"abstract":"The matching accuracy of a biometric system is typically quantified through measures such as the False Match Rate (FMR), False Non-match Rate (FNMR), Equal Error Rate (EER), Receiver Operating Characteristic (ROC) curve and Cumulative Match Characteristic (CMC) curve. In this work, we analyze the relationship between the ROC and CMC curves, which are two measures commonly used to describe the performance of verification and identification systems, respectively. We establish that it is possible for a biometric system to exhibit “good” verification performance and “poor” identification performance (and vice versa) by demonstrating the conditions required to produce such outcomes. Experimental analysis using synthetically generated match scores confirms our hypothesis that the ROC or CMC alone cannot completely characterize biometric system performance.","PeriodicalId":396789,"journal":{"name":"2012 IEEE International Workshop on Information Forensics and Security (WIFS)","volume":"47 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116889228","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 23
期刊
2012 IEEE International Workshop on Information Forensics and Security (WIFS)
全部 ENVIRONMENT Geostand. Geoanal. Res. Chin. Phys. C CRIT REV ENV SCI TEC Ecol. Processes Appl. Geochem. Ann. Glaciol. Nat. Geosci. Eurasian Journal of Emergency Medicine Chem. Ecol. Expert Opin. Pharmacother. J. Hydrol. ECOLOGY Fossil Rec. Environ. Technol. Innovation AAPG Bull. J APPL METEOROL CLIM J PHYS-CONDENS MAT ACTA GEOL POL Geosci. Front. Hydrol. Processes 2012 IEEE International Workshop on Antenna Technology (iWAT) Environment and Natural Resources Journal 非金属矿 GROUNDWATER ARCT ANTARCT ALP RES Chin. Phys. Lett. Space Weather EUR PHYS J-APPL PHYS Quat. Res. Environmental Claims Journal Conserv. Genet. Resour. ARCH ACOUST FITOTERAPIA IEEE Magn. Lett. Ocean Sci. Geodezia es Kartografia J. Clim. J. Cosmol. Astropart. Phys. Environmental Toxicology & Water Quality Prog. Oceanogr. RADIOCARBON ACTA ORTHOP BELG Études Caribéennes Erziehungswissenschaftliche Revue 2011 International Conference on Computer Distributed Control and Intelligent Environmental Monitoring FACIAL PLAST SURG Int. J. Biometeorol. OPT APPL "Laboratorio;" analisis clinicos, bacteriologia, inmunologia, parasitologia, hematologia, anatomia patologica, quimica clinica Communications Earth & Environment Org. Geochem. Energy Ecol Environ Terra Nova Atmos. Chem. Phys. Carbon Balance Manage. 测绘科学技术 Environ. Toxicol. Pharmacol. Clean-Soil Air Water Environ. Educ. Res, Geochem. Int. EVOL MED PUBLIC HLTH Geol. Ore Deposits Clim. Change 2008 Conference on Lasers and Electro-Optics and 2008 Conference on Quantum Electronics and Laser Science ENVIRON HEALTH-GLOB ECOL RESTOR EXPERT OPIN DRUG DEL Ecol. Monogr. Condens. Matter Phys. Ecol. Indic. ECOTOXICOLOGY Astrophys. J. Suppl. Ser. COMP BIOCHEM PHYS C Acta Oceanolog. Sin. GEOTECH LETT Atmos. Res. Environ. Prog. Sustainable Energy Adv. Meteorol. Clean Technol. Environ. Policy ATMOSPHERE-BASEL Appl. Clay Sci. ARCHAEOMETRY Am. Mineral. Geobiology ACTA GEOL SIN-ENGL IZV-PHYS SOLID EART+ Yan Ke Xue Bao (Hong Kong) ACTA PETROL SIN J. Space Weather Space Clim. J. Atmos. Chem. Environ. Eng. Manage. J. ECOSYSTEMS Ecol. Res. ITAL J REMOTE SENS Aquat. Geochem. Energy Environ. Environ. Mol. Mutagen. 航空科学与技术(英文) ENG SANIT AMBIENT
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1