Digital Forensics and Cyber Crime: 9th International Conference, ICDF2C 2017, Prague, Czech Republic, October 9-11, 2017, Proceedings

235 Pages·2018·18.03 MB·English

by  Petr Matoušek

Petr Matoušek
Martin Schmiedecker (Eds.)
216
Digital Forensics
and Cyber Crime
9th International Conference, ICDF2C 2017
Prague, Czech Republic, October 9–11, 2017
Proceedings
123
Lecture Notes of the Institute
for Computer Sciences, Social Informatics
and Telecommunications Engineering 216
Editorial Board
Ozgur Akan
Middle East Technical University, Ankara, Turkey
Paolo Bellavista
University of Bologna, Bologna, Italy
Jiannong Cao
Hong Kong Polytechnic University, Hong Kong, Hong Kong
Geoffrey Coulson
Lancaster University, Lancaster, UK
Falko Dressler
University of Erlangen, Erlangen, Germany
Domenico Ferrari
Università Cattolica Piacenza, Piacenza, Italy
Mario Gerla
UCLA, Los Angeles, USA
Hisashi Kobayashi
Princeton University, Princeton, USA
Sergio Palazzo
University of Catania, Catania, Italy
Sartaj Sahni
University of Florida, Florida, USA
Xuemin Sherman Shen
University of Waterloo, Waterloo, Canada
Mircea Stan
University of Virginia, Charlottesville, USA
Jia Xiaohua
City University of Hong Kong, Kowloon, Hong Kong
Albert Y. Zomaya
University of Sydney, Sydney, Australia
More information about this series at http://www.springer.com/series/8197
š
Petr Matou ek Martin Schmiedecker (Eds.)
(cid:129)
Digital Forensics
and Cyber Crime
9th International Conference, ICDF2C 2017
–
Prague, Czech Republic, October 9 11, 2017
Proceedings
123
Editors
Petr Matoušek Martin Schmiedecker
BrnoUniversity ofTechnology SBAResearch Vienna
Brno Vienna
Czech Republic Austria
ISSN 1867-8211 ISSN 1867-822X (electronic)
Lecture Notesof the Institute for Computer Sciences, Social Informatics
andTelecommunications Engineering
ISBN 978-3-319-73696-9 ISBN978-3-319-73697-6 (eBook)
https://doi.org/10.1007/978-3-319-73697-6
LibraryofCongressControlNumber:2017963758
©ICSTInstituteforComputerSciences,SocialInformaticsandTelecommunicationsEngineering2018
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartofthe
material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilarmethodologynow
knownorhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication
doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant
protectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthorsandtheeditorsaresafetoassumethattheadviceandinformationinthisbookare
believedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsortheeditors
give a warranty, express or implied, with respect to the material contained herein or for any errors or
omissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictionalclaimsin
publishedmapsandinstitutionalaffiliations.
Printedonacid-freepaper
ThisSpringerimprintispublishedbySpringerNature
TheregisteredcompanyisSpringerInternationalPublishingAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Preface
Itisourpleasuretointroducetheproceedingsofthe9thEAIInternationalConference
on Digital Forensics and Cyber Crime (ICDF2C) 2017. Since its start in 2009, the
ICDF2C conference each year brings together leading researchers, practitioners, and
educatorsfromaroundtheworldtoadvancethestateoftheartindigitalforensicsand
cybercrime investigation. After nine years of existence, the conference has received
worldwide recognition. Scores of researches and experts of digital forensics and
cybercrime come together each year to meet at this event.
TheTechnicalProgramCommittee(PC)ofICDF2Creceivedabout50submissions
that were carefully evaluated by the team of international reviewers. After the review,
18paperswereinvitedfororalpresentationatICDF2C2017.Theauthorsofthepapers
come from 11 countries over the world: UK, China, Czech Republic, Germany,
Austria, Switzerland, USA, Portugal, Sweden, Ireland, Australia, and South Korea.
Traditionally,theprogramofICDF2Cfeatureskeynotespeeches.Thisyearwehad
the privilege to welcome Joshua I. James, a professor and researcher from Hallym
University, South Korea, whose research focuses on event reconstruction in
post-mortem digital investigations. The second keynote speaker was Felix Freiling
from Friedrich-Alexander-Universität in Erlangen-Nürnberg, Germany, who is an
expert on safety and security. For the third keynote, Domingo Montanaro and Cyllas
Eliapresentedtheirresultsofatwo-yearlonginvestigationofcybercriminalsinBrazil.
The program also accommodated three tutorials given to the ICDF2C audience:
Bitcoin analysis by experts from the cybersecurity lab Neutrino, Switzerland; an
application of NetFlow data for network forensics given by Flowmon Networks Ltd.,
Czech Republic; and an introduction to the GRR Rapid Response framework for
remote live forensics, given by Google.
We would like to thank everyone who offered their help and support during the
conferenceorganization.Weappreciatethethoroughworkandflexibleapproachofall
PCmembersduringthereviewingprocess.Also,wewouldliketoexpressoursincere
thanks to all members of the Organizing Committee for their hard work in the real-
ization of the conference. The conference could not have been organized without the
support of the European Alliance for Innovation (EAI) and Flowmon Networks Ltd.,
Czech Republic.
December 2017 Petr Matousek
Martin Schmiedecker
Organization
Steering Committee
Sanjay Goel University at Albany, State University of New York,
USA
Imrich Chlamtac EAI, CREATE-NET
Pavel Gladyshev University College, Dublin, Ireland
Marcus Rogers Purdue University, USA
Ibrahim Baggili University of New Haven, USA
Joshua I. James DFIRE Labs, Hallym University, South Korea
Frank Breitinger University of New Haven, USA
Organizing Committee
General Co-chairs
Petr Matoušek Brno University of Technology, Czech Republic
Martin Schmiedecker SBA Research, Vienna, Austria
Technical Program Committee Chair
Sebastian Schinzel University of Applied Sciences, Münster, Germany
Workshop Chair
Marc Scanlon University College Dublin, Ireland
Publicity and Web Chair
Sebastian Neuner SBA Research, Vienna, Austria
Publications Chair
Ondřej Ryšavý Faculty of Information Technology, Brno, Czech
Republic
Local Chair
Matěj Grégr Brno University of Technology, Brno, Czech Republic
Conference Coordinator
Alzbeta Mackova EAI
VIII Organization
Technical Program Committee
Harald Baier University of Applied Sciences Darmstadt, Germany
Spiridon Bakiras Hamad Bin Khalifa University, Qatar
Nicole Beebe University of Texas at San Antonio, USA
Frank Breitinger University of New Haven, USA
Mohamed Chawki University of Lyon III, France
Kim-Kwang Raymond University of South Australia, Australia
Choo
David Dampier Mississippi State University, USA
Virginia Franqueira University of Derby, UK
Pavel Gladyshev University College Dublin, Ireland
Joshua I. James DigitalFIRE Labs, Hallym University, South Korea
Ping Ji City University of New York, USA
Umit Karabiyik Sam Houston State University, USA
Nhien An Le Khac UCD School of Computer Science, Ireland
Michael Losavio University of Louisville, USA
Stig Mjolsnes Norwegian University of Science
and Technology NTNU, Norway
Alex Nelson NIST, USA
Sebastian Neuner SBA Research, Austria
Bruce Nikkel UBS AG, Switzerland
Richard E. Overill King’s College London, UK
Gilbert Peterson Air Force Institute of Technology, USA
Golden G Richard III Louisiana State University, USA
Vassil Roussev University of New Orleans, USA
Neil Rowe U.S. Naval Postgraduate School, USA
Ondřej Ryšavý Brno University of Technology, Czech Republic
Mark Scanlon University College Dublin, Ireland
Bradley Schatz Queensland University of Technology, Australia
Michael Spreitzenbarth Siemens CERT, Germany
Krzysztof Szczypiorski Warsaw University of Technology, Poland
Vladimír Veselý Brno University of Technology, Czech Republic
Timothy Vidas Carnegie Mellon University, USA
Christian Winter Fraunhofer Gesellschaft, Germany
Contents
Malware and Botnet
FindEvasion: An Effective Environment-Sensitive Malware Detection
System for the Cloud. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Xiaoqi Jia, Guangzhe Zhou, Qingjia Huang, Weijuan Zhang,
and Donghai Tian
Real-Time Forensics Through Endpoint Visibility. . . . . . . . . . . . . . . . . . . . 18
Peter Kieseberg, Sebastian Neuner, Sebastian Schrittwieser,
Martin Schmiedecker, and Edgar Weippl
On Locky Ransomware, Al Capone and Brexit. . . . . . . . . . . . . . . . . . . . . . 33
John MacRae and Virginia N. L. Franqueira
Deanonymization
Finding and Rating Personal Names on Drives for Forensic Needs . . . . . . . . 49
Neil C. Rowe
A Web-Based Mouse Dynamics Visualization Tool for User Attribution
in Digital Forensic Readiness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Dominik Ernsberger, R. Adeyemi Ikuesan, S. Hein Venter,
and Alf Zugenmaier
Digital Forensics Tools I
Open Source Forensics for a Multi-platform Drone System . . . . . . . . . . . . . 83
Thomas Edward Allen Barton and M. A. Hannan Bin Azhar
A Novel File Carving Algorithm for EVTX Logs. . . . . . . . . . . . . . . . . . . . 97
Ming Xu, Jinkai Sun, Ning Zheng, Tong Qiao, Yiming Wu,
Kai Shi, Haidong Ge, and Tao Yang
Fuzzy System-Based Suspicious Pattern Detection in Mobile
Forensic Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Konstantia Barmpatsalou, Tiago Cruz, Edmundo Monteiro,
and Paulo Simoes
X Contents
Cyber Crime Investigation and Digital Forensics Triage
DigitalForensicReadinessinCriticalInfrastructures:ACaseofSubstation
Automation in the Power Sector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
Asif Iqbal, Mathias Ekstedt, and Hanan Alobaidli
A Visualization Scheme for Network Forensics Based on Attribute
Oriented Induction Based Frequent Item Mining and Hyper Graph . . . . . . . . 130
Jianguo Jiang, Jiuming Chen, Kim-Kwang Raymond Choo,
Chao Liu, Kunying Liu, and Min Yu
Expediting MRSH-v2 Approximate Matching with Hierarchical
Bloom Filter Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
David Lillis, Frank Breitinger, and Mark Scanlon
Approxis: A Fast, Robust, Lightweight and Approximate
Disassembler Considered in the Field of Memory Forensics. . . . . . . . . . . . . 158
Lorenz Liebler and Harald Baier
Digital Forensics Tools Testing and Validation
Memory Forensics and the Macintosh OS X Operating System. . . . . . . . . . . 175
Charles B. Leopard, Neil C. Rowe, and Michael R. McCarrin
Sketch-Based Modeling and Immersive Display Techniques for Indoor
Crime Scene Presentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Pu Ren, Mingquan Zhou, Jin Liu, Yachun Fan, Wenshuo Zhao,
and Wuyang Shui
An Overview of the Usage of Default Passwords . . . . . . . . . . . . . . . . . . . . 195
Brandon Knieriem, Xiaolu Zhang, Philip Levine, Frank Breitinger,
and Ibrahim Baggili
Hacking
Automation of MitM Attack on Wi-Fi Networks. . . . . . . . . . . . . . . . . . . . . 207
Martin Vondráček, Jan Pluskal, and Ondřej Ryšavý
SeEagle: Semantic-Enhanced Anomaly Detection for Securing Eagle. . . . . . . 221
Wu Xin, Qingni Shen, Yahui Yang, and Zhonghai Wu
Coriander: A Toolset for Generating Realistic Android Digital
Evidence Datasets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Irvin Homem
Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235