29 results

Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems

Journal Article
Mckeown, S., Russell, G., & Leimich, P. (2020)
Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems. Journal of Digital Forensics, Security and Law, 14(3),
A common investigative task is to identify known contraband images on a device, which typically involves calculating cryptographic hashes for all the files on a disk and check...

WaterLeakage: A Stealthy Malware for Data Exfiltration on Industrial Control Systems Using Visual Channels

Conference Proceeding
Robles-Durazno, A., Moradpoor, N., McWhinnie, J., & Russell, G. (2019)
WaterLeakage: A Stealthy Malware for Data Exfiltration on Industrial Control Systems Using Visual Channels. In Proceedings of 15th IEEE International Conference on Control & Automation (ICCA)https://doi.org/10.1109/ICCA.2019.8899564
Industrial Control Systems (ICS) have faced a growing number of threats over the past few years. Reliance on isolated controls networks or air-gapped computers is no longer a ...

Deriving ChaCha20 Key Streams From Targeted Memory Analysis

Journal Article
McLaren, P., Buchanan, W. J., Russell, G., & Tan, Z. (2019)
Deriving ChaCha20 Key Streams From Targeted Memory Analysis. Journal of Information Security and Applications, 48, https://doi.org/10.1016/j.jisa.2019.102372
There can be performance and vulnerability concerns with block ciphers, thus stream ciphers can used as an alternative. Although many symmetric key stream ciphers are fairly r...

PLC Memory Attack Detection and Response in a Clean Water Supply System

Journal Article
Robles-Durazno, A., Moradpoor, N., McWhinnie, J., Russell, G., & Maneru-Marin, I. (2019)
PLC Memory Attack Detection and Response in a Clean Water Supply System. International Journal of Critical Infrastructure Protection, 26, https://doi.org/10.1016/j.ijcip.2019.05.003
Industrial Control Systems (ICS) are frequently used in manufacturing and critical infrastructures like water treatment, chemical plants, and transportation schemes. Citizens ...

Decrypting Live SSH Traffic in Virtual Environments

Journal Article
Mclaren, P., Russell, G., Buchanan, W. J., & Tan, Z. (2019)
Decrypting Live SSH Traffic in Virtual Environments. Digital Investigation, 29, 109-117. https://doi.org/10.1016/j.diin.2019.03.010
Decrypting and inspecting encrypted malicious communications may assist crime detection and prevention. Access to client or server memory enables the discovery of artefacts re...

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

Conference Proceeding
Robles-Durazno, A., Moradpoor, N., McWhinnie, J., & Russell, G. (2018)
A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system. In Proceedings of the IEEE International Conference on Cyber Security and Protection of Digital Services (Cyber Security 2018)https://doi.org/10.1109/CyberSecPODS.2018.8560683
Industrial Control Systems are part of our daily life in industries such as transportation, water, gas, oil, smart cities, and telecommunications. Technological development ov...

Reducing the Impact of Network Bottlenecks on Remote Contraband Detection

Conference Proceeding
McKeown, S., Russell, G., & Leimich, P. (2018)
Reducing the Impact of Network Bottlenecks on Remote Contraband Detection. In 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)https://doi.org/10.1109/CyberSecPODS.2018.8560671
Cloud based storage is increasing in popularity, with large volumes of data being stored remotely. Digital forensics investigators examining such systems remotely are limited ...

Sub-file Hashing Strategies for Fast Contraband Detection

Conference Proceeding
McKeown, S., Russell, G., & Leimich, P. (2018)
Sub-file Hashing Strategies for Fast Contraband Detection. In 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)https://doi.org/10.1109/CyberSecPODS.2018.8560680
Traditional digital forensics processes do not scale well with the huge quantities of data present in a modern investigation, resulting in large investigative backlogs for man...

Fingerprinting JPEGs With Optimised Huffman Tables

Journal Article
McKeown, S., Russell, G., & Leimich, P. (2018)
Fingerprinting JPEGs With Optimised Huffman Tables. Journal of Digital Forensics, Security and Law, 13(2), https://doi.org/10.15394/jdfsl.2018.1451
A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algor...

Machine learning and semantic analysis of in-game chat for cyber bullying

Journal Article
Murnion, S., Buchanan, W. J., Smales, A., & Russell, G. (2018)
Machine learning and semantic analysis of in-game chat for cyber bullying. Computers and Security, 76, 197-213. https://doi.org/10.1016/j.cose.2018.02.016
One major problem with cyberbullying research is the lack of data, since researchers are traditionally forced to rely on survey data where victims and perpetrators self-report...