Mining malware command and control traces
Conference Proceeding
McLaren, P., Russell, G., & Buchanan, B. (2018)
Mining malware command and control traces. In Proceedings of the SAI Computing Conference 2017https://doi.org/10.1109/SAI.2017.8252185
Detecting botnets and advanced persistent threats is a major challenge for network administrators. An important component of such malware is the command and control channel, w...
WaterLeakage: A Stealthy Malware for Data Exfiltration on Industrial Control Systems Using Visual Channels
Conference Proceeding
Robles-Durazno, A., Moradpoor, N., McWhinnie, J., & Russell, G. (2019)
WaterLeakage: A Stealthy Malware for Data Exfiltration on Industrial Control Systems Using Visual Channels. In Proceedings of 15th IEEE International Conference on Control & Automation (ICCA)https://doi.org/10.1109/ICCA.2019.8899564
Industrial Control Systems (ICS) have faced a growing number of threats over the past few years. Reliance on isolated controls networks or air-gapped computers is no longer a ...
Teaching penetration and malware analysis in a cloud-based environment.
Presentation / Conference
Buchanan, W. J., Ramsay, B., Macfarlane, R., Smales, A., & Russell, G. (2015, June)
Teaching penetration and malware analysis in a cloud-based environment. Paper presented at UK Workshop on Cybersecurity Training & Education, Liverpool
This paper outlines evaluation of running a private Cloud-based system over two semesters at Edinburgh Napier University for two modules: Security Testing and Advanced Network...
Fast Filtering of Known PNG Files Using Early File Features
Conference Proceeding
McKeown, S., Russell, G., & Leimich, P. (2017)
Fast Filtering of Known PNG Files Using Early File Features. In Proceedings of the Conference on Digital Forensics, Security and Law
A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algor...
Fingerprinting JPEGs With Optimised Huffman Tables
Journal Article
McKeown, S., Russell, G., & Leimich, P. (2018)
Fingerprinting JPEGs With Optimised Huffman Tables. Journal of Digital Forensics, Security and Law, 13(2), https://doi.org/10.15394/jdfsl.2018.1451
A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algor...
Sub-file Hashing Strategies for Fast Contraband Detection
Conference Proceeding
McKeown, S., Russell, G., & Leimich, P. (2018)
Sub-file Hashing Strategies for Fast Contraband Detection. In 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)https://doi.org/10.1109/CyberSecPODS.2018.8560680
Traditional digital forensics processes do not scale well with the huge quantities of data present in a modern investigation, resulting in large investigative backlogs for man...
Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems
Journal Article
Mckeown, S., Russell, G., & Leimich, P. (2020)
Fast Forensic Triage Using Centralised Thumbnail Caches on Windows Operating Systems. Journal of Digital Forensics, Security and Law, 14(3),
A common investigative task is to identify known contraband images on a device, which typically involves calculating cryptographic hashes for all the files on a disk and check...
Real-time monitoring of privacy abuses and intrusion detection in android system
Conference Proceeding
Li, S., Chen, J., Spyridopoulos, T., Andriotis, P., Ludwiniak, R., & Russell, G. (2015)
Real-time monitoring of privacy abuses and intrusion detection in android system. In Human Aspects of Information Security, Privacy, and Trust. , (379-390). https://doi.org/10.1007/978-3-319-20376-8_34
In this paper, we investigated the definition of privacy, privacy abuse behaviours, and the privacy abuse in Android systems, which may be very useful for identifying the mali...
Decrypting Live SSH Traffic in Virtual Environments
Journal Article
Mclaren, P., Russell, G., Buchanan, W. J., & Tan, Z. (2019)
Decrypting Live SSH Traffic in Virtual Environments. Digital Investigation, 29, 109-117. https://doi.org/10.1016/j.diin.2019.03.010
Decrypting and inspecting encrypted malicious communications may assist crime detection and prevention. Access to client or server memory enables the discovery of artefacts re...
Machine learning and semantic analysis of in-game chat for cyber bullying
Journal Article
Murnion, S., Buchanan, W. J., Smales, A., & Russell, G. (2018)
Machine learning and semantic analysis of in-game chat for cyber bullying. Computers and Security, 76, 197-213. https://doi.org/10.1016/j.cose.2018.02.016
One major problem with cyberbullying research is the lack of data, since researchers are traditionally forced to rely on survey data where victims and perpetrators self-report...