Sean McKeown
Sean McKeown

Dr Sean McKeown

Lecturer

Biography

Sean McKeown is an early career academic at Edinburgh Napier University, focusing in the areas of Digital Forensic and Digital investigations, as well as general Cyber Security. Prior to joining Napier, Sean worked on Open-Source Intelligence (OSINT) investigations, while his PhD moved to focus on fast digital forensics processing techniques, particularly for non-mechanical media. His PhD research drew the attention of a local forensics spinout after a presentation at SICSA Demofest in 2017, resulting in talks about how such an approach may be incorporated in commercial products.

Sean is particularly interest in image file formats and their various use cases in digital forensics. Recent work has had a focus on the High Efficiency Image File Format (HEIF), used in modern Apple devices, and Perceptual Hashing. In the former case it was discovered that existing forensics tooling, even expensive commercial tooling available to law enforcement, isn’t particularly well equipped to handle it. He is in the process of releasing tooling that will help alleviate this deficit in capability, though he has already had conversations about the format with developers from Griffeye and Hansken. Similarly, noting that there is a dearth of evidence-based evaluation of Perceptual Hashing techniques, he is also in the process of expanding on the existing public evaluation and producing a framework to allow others to do the same.

The Perceptual Hashing work is forming the basis of an EPSRC New Investigator grant application, which is currently under development – the foundations of which were laid in the Safety Tech Challenge Fund award he was heavily involved in. The bid will seek to further develop public understanding and deployment of such technologies, particularly to understand their behaviour at scale.

Going forward, in addition to Perceptual Hashing evaluation, Sean is also keen to explore the forensics implications and tooling surrounding generative AI technologies, such as stable diffusion. Towards this end, he is taking on a PhD student to further explore this topic.

Events

Esteem

Conference Organising Activity

  • Organising Comittee - CMRiC Cyber 2024

 

Fellowships and Awards

  • Edinburgh Napier Researcher Development Fund
  • Edinburgh Napier 50th Anniversary PhD Scholarship

 

Invited Speaker

  • University of Glasgow - HATII SHAKE Seminar

 

Membership of Professional Body

  • Fellow of the Higher Education Academy

 

Reviewing

  • IEEE Conference on Dependable and Secure Computing
  • MDPI Applied Sciences Journal
  • 14th International Conference on Security of Information and Networks
  • MDPI Sensors Journal
  • Programme Committee - IEEE International Conference on Cyber Science comprising Cyber Situational Awareness, Social Media, Cyber Security and Cyber Incident Response
  • Journal of Cyber Security Technology
  • CMRiC Cyber Science 202X
  • Journal of Digital Forensics, Security and Law (JDFSL)
  • Technical Comittee Member - IARIA Cyber 2019

 

Date


21 results

Towards Identifying Human Actions, Intent, and Severity of APT Attacks Applying Deception Techniques - An Experiment

Conference Proceeding
Chacon, J., Mckeown, S., & Macfarlane, R. (2020)
Towards Identifying Human Actions, Intent, and Severity of APT Attacks Applying Deception Techniques - An Experiment. https://doi.org/10.1109/CyberSecurity49315.2020.9138859
Attacks by Advanced Persistent Threats (APTs) have been shown to be difficult to detect using traditional signature-and anomaly-based intrusion detection approaches. Deception...

Forensic Considerations for the High Efficiency Image File Format (HEIF)

Conference Proceeding
Mckeown, S., & Russell, G. (2020)
Forensic Considerations for the High Efficiency Image File Format (HEIF). https://doi.org/10.1109/CyberSecurity49315.2020.9138890
The High Efficiency File Format (HEIF) was adopted by Apple in 2017 as their favoured means of capturing images from their camera application, with Android devices such as the...

Testing And Hardening IoT Devices Against the Mirai Botnet

Conference Proceeding
Kelly, C., Pitropakis, N., McKeown, S., & Lambrinoudakis, C. (2020)
Testing And Hardening IoT Devices Against the Mirai Botnet. https://doi.org/10.1109/CyberSecurity49315.2020.9138887
A large majority of cheap Internet of Things (IoT) devices that arrive brand new, and are configured with out-of-the-box settings, are not being properly secured by the manufa...

Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems

Journal Article
Mckeown, S., Russell, G., & Leimich, P. (2020)
Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems. Journal of Digital Forensics, Security and Law, 14(3),
A common investigative task is to identify known contraband images on a device, which typically involves calculating cryptographic hashes for all the files on a disk and check...

Utilising Reduced File Representations to Facilitate Fast Contraband Detection

Thesis
McKeown, S. Utilising Reduced File Representations to Facilitate Fast Contraband Detection. (Thesis)
Edinburgh Napier University. Retrieved from http://researchrepository.napier.ac.uk/Output/2386199
Digital forensics practitioners can be tasked with analysing digital data, in all its forms, for legal proceedings. In law enforcement, this largely involves searching for con...

Sub-file Hashing Strategies for Fast Contraband Detection

Conference Proceeding
McKeown, S., Russell, G., & Leimich, P. (2018)
Sub-file Hashing Strategies for Fast Contraband Detection. In 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)https://doi.org/10.1109/CyberSecPODS.2018.8560680
Traditional digital forensics processes do not scale well with the huge quantities of data present in a modern investigation, resulting in large investigative backlogs for man...

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

Conference Proceeding
McKeown, S., Russell, G., & Leimich, P. (2018)
Reducing the Impact of Network Bottlenecks on Remote Contraband Detection. In 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)https://doi.org/10.1109/CyberSecPODS.2018.8560671
Cloud based storage is increasing in popularity, with large volumes of data being stored remotely. Digital forensics investigators examining such systems remotely are limited ...

Fingerprinting JPEGs With Optimised Huffman Tables

Journal Article
McKeown, S., Russell, G., & Leimich, P. (2018)
Fingerprinting JPEGs With Optimised Huffman Tables. Journal of Digital Forensics, Security and Law, 13(2), https://doi.org/10.15394/jdfsl.2018.1451
A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algor...

Fast Filtering of Known PNG Files Using Early File Features

Conference Proceeding
McKeown, S., Russell, G., & Leimich, P. (2017)
Fast Filtering of Known PNG Files Using Early File Features. In Proceedings of the Conference on Digital Forensics, Security and Law
A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algor...

InfoScout: An interactive, entity centric, person search tool.

Conference Proceeding
McKeown, S., Buivys, M., & Azzopardi, L. (2016)
InfoScout: An interactive, entity centric, person search tool. In SIGIR '16 Proceedings of the 39th International ACM SIGIR conference on Research and Development in Information Retrieval, (1113-1116). https://doi.org/10.1145/2911451.2911468
Individuals living in highly networked societies publish a large amount of personal, and potentially sensitive, information online. Web investigators can exploit such informat...

Pre-Napier Funded Projects

  • SICSA Elevate Business Accelerator Training
  • SICSA Postgraduate Industry Internship

Current Post Grad projects

Previous Post Grad projects