With the rapid advancement of visual generative models such as Generative Adversarial Networks(GANs)and stable Diffusion,the creation of highly realistic Deepfake through automated forgery has significantly progressed...With the rapid advancement of visual generative models such as Generative Adversarial Networks(GANs)and stable Diffusion,the creation of highly realistic Deepfake through automated forgery has significantly progressed.This paper examines the advancements inDeepfake detection and defense technologies,emphasizing the shift from passive detection methods to proactive digital watermarking techniques.Passive detection methods,which involve extracting features from images or videos to identify forgeries,encounter challenges such as poor performance against unknown manipulation techniques and susceptibility to counter-forensic tactics.In contrast,proactive digital watermarking techniques embed specificmarkers into images or videos,facilitating real-time detection and traceability,thereby providing a preemptive defense againstDeepfake content.We offer a comprehensive analysis of digitalwatermarking-based forensic techniques,discussing their advantages over passivemethods and highlighting four key benefits:real-time detection,embedded defense,resistance to tampering,and provision of legal evidence.Additionally,the paper identifies gaps in the literature concerning proactive forensic techniques and suggests future research directions,including cross-domain watermarking and adaptive watermarking strategies.By systematically classifying and comparing existing techniques,this review aims to contribute valuable insights for the development of more effective proactive defense strategies in Deepfake forensics.展开更多
Images and videos play an increasingly vital role in daily life and are widely utilized as key evidentiary sources in judicial investigations and forensic analysis.Simultaneously,advancements in image and video proces...Images and videos play an increasingly vital role in daily life and are widely utilized as key evidentiary sources in judicial investigations and forensic analysis.Simultaneously,advancements in image and video processing technologies have facilitated the widespread availability of powerful editing tools,such as Deepfakes,enabling anyone to easily create manipulated or fake visual content,which poses an enormous threat to social security and public trust.To verify the authenticity and integrity of images and videos,numerous approaches have been proposed,which are primarily based on content analysis and their effectiveness is susceptible to interference from various image or video post-processing operations.Recent research has highlighted the potential of file containers analysis as a promising forensic approach that offers efficient and interpretable results.However,there is still a lack of review articles on this kind of approach.In order to fill this gap,we present a comprehensive review of file containers-based image and video forensics in this paper.Specifically,we categorize the existing methods into two distinct stages,qualitative analysis and quantitative analysis.In addition,an overall framework is proposed to organize the exiting approaches.Then,the advantages and disadvantages of the schemes used across different forensic tasks are provided.Finally,we outline the trends in this research area,aiming to provide valuable insights and technical guidance for future research.展开更多
In this research,we developed a plugin for our automated digital forensics framework to extract and preserve the evidence from the Android and the IOS-based mobile phone application,Instagram.This plugin extracts pers...In this research,we developed a plugin for our automated digital forensics framework to extract and preserve the evidence from the Android and the IOS-based mobile phone application,Instagram.This plugin extracts personal details from Instagram users,e.g.,name,user name,mobile number,ID,direct text or audio,video,and picture messages exchanged between different Instagram users.While developing the plugin,we identified resources available in both Android and IOS-based devices holding key forensics artifacts.We highlighted the poor privacy scheme employed by Instagram.This work,has shown how the sensitive data posted in the Instagram mobile application can easily be reconstructed,and how the traces,as well as the URL links of visual messages,can be used to access the privacy of any Instagram user without any critical credential verification.We also employed the anti-forensics method on the Instagram Android’s application and were able to restore the application from the altered or corrupted database file,which any criminal mind can use to set up or trap someone else.The outcome of this research is a plugin for our digital forensics ready framework software which could be used by law enforcement and regulatory agencies to reconstruct the digital evidence available in the Instagram mobile application directories on both Android and IOS-based mobile phones.展开更多
In today’s digital era,the rapid evolution of image editing technologies has brought about a significant simplification of image manipulation.Unfortunately,this progress has also given rise to the misuse of manipulat...In today’s digital era,the rapid evolution of image editing technologies has brought about a significant simplification of image manipulation.Unfortunately,this progress has also given rise to the misuse of manipulated images across various domains.One of the pressing challenges stemming from this advancement is the increasing difficulty in discerning between unaltered and manipulated images.This paper offers a comprehensive survey of existing methodologies for detecting image tampering,shedding light on the diverse approaches employed in the field of contemporary image forensics.The methods used to identify image forgery can be broadly classified into two primary categories:classical machine learning techniques,heavily reliant on manually crafted features,and deep learning methods.Additionally,this paper explores recent developments in image forensics,placing particular emphasis on the detection of counterfeit colorization.Image colorization involves predicting colors for grayscale images,thereby enhancing their visual appeal.The advancements in colorization techniques have reached a level where distinguishing between authentic and forged images with the naked eye has become an exceptionally challenging task.This paper serves as an in-depth exploration of the intricacies of image forensics in the modern age,with a specific focus on the detection of colorization forgery,presenting a comprehensive overview of methodologies in this critical field.展开更多
The smart home platform integrates with Internet of Things(IoT)devices,smartphones,and cloud servers,enabling seamless and convenient services.It gathers and manages extensive user data,including personal information,...The smart home platform integrates with Internet of Things(IoT)devices,smartphones,and cloud servers,enabling seamless and convenient services.It gathers and manages extensive user data,including personal information,device operations,and patterns of user behavior.Such data plays an essential role in criminal inves-tigations,highlighting the growing importance of specialized smart home forensics.Given the rapid advancement in smart home software and hardware technologies,many companies are introducing new devices and services that expand the market.Consequently,scalable and platform-specific forensic research is necessary to support efficient digital investigations across diverse smart home ecosystems.This study thoroughly examines the core components and structures of smart homes,proposing a generalized architecture that represents various operational environments.A three-stage smart home forensics framework is introduced:(1)analyzing application functions to infer relevant data,(2)extracting and processing data from interconnected devices,and(3)identifying data valuable for investigative purposes.The framework’s applicability is validated using testbeds from Samsung SmartThings and Xiaomi Mi Home platforms,offering practical insights for real-world forensic applications.The results demonstrate that the proposed forensic framework effectively acquires and classifies relevant digital evidence in smart home platforms,confirming its practical applicability in smart home forensic investigations.展开更多
Second level dactyloscopic markants(minutiae)are irregularities in the course of the friction ridge skin used for personal identification because of their high variability.Individual uniqueness is affected by the high...Second level dactyloscopic markants(minutiae)are irregularities in the course of the friction ridge skin used for personal identification because of their high variability.Individual uniqueness is affected by the high number of minutiae and their random distribution within the friction ridge skin.The combination of various environmental factors,e.g.,snow,soil environment,and direct sunlight,can affect the quality of fingerprints.The aim of this study was to analyze the influence of snow under two different conditions(natural snowfall and immersion in the snow)within various time intervals on fingerprints.A total of 265 groomed latent distal fingerprints were taken from a Caucasian male from Slovakia.Latent fingerprints were taken only from one participant,as the composition of sweat,i.e.,the sweat-fat substance,varies from person to person,which could influence the results.Subsequently,obtained latent fingerprints were developed using small particle reagent.We evaluated the decrease in the number of minutiae on latent fingerprints exposed to the destructive influence of snow.The results confirmed that snow has a significant effect on the quality of latent fingerprints,as a decrease in the average number of minutiae on latent prints was observed after only 2 h of exposure to snow conditions.After snow exposure,usable fingerprints for identification decreased,whilst non-usable ones increased,with 53.33%of non-usable fingerprints resulting from natural snowfall exposure.After exposure of latent fingerprints to snow immersion,98.13%of non-usable fingerprints were found.The results can help improving personal identification efficiency.展开更多
The multi-purpose forensics is an important tool for forge image detection.In this paper,we propose a universal feature set for the multi-purpose forensics which is capable of simultaneously identifying several typica...The multi-purpose forensics is an important tool for forge image detection.In this paper,we propose a universal feature set for the multi-purpose forensics which is capable of simultaneously identifying several typical image manipulations,including spatial low-pass Gaussian blurring,median filtering,re-sampling,and JPEG compression.To eliminate the influences caused by diverse image contents on the effectiveness and robustness of the feature,a residual group which contains several high-pass filtered residuals is introduced.The partial correlation coefficient is exploited from the residual group to purely measure neighborhood correlations in a linear way.Besides that,we also combine autoregressive coefficient and transition probability to form the proposed composite feature which is used to measure how manipulations change the neighborhood relationships in both linear and non-linear way.After a series of dimension reductions,the proposed feature set can accelerate the training and testing for the multi-purpose forensics.The proposed feature set is then fed into a multi-classifier to train a multi-purpose detector.Experimental results show that the proposed detector can identify several typical image manipulations,and is superior to the complicated deep CNN-based methods in terms of detection accuracy and time efficiency for JPEG compressed image with low resolution.展开更多
In the paper,a convolutional neural network based on quaternion transformation is proposed to detect median filtering for color images.Compared with conventional convolutional neural network,color images can be proces...In the paper,a convolutional neural network based on quaternion transformation is proposed to detect median filtering for color images.Compared with conventional convolutional neural network,color images can be processed in a holistic manner in the proposed scheme,which makes full use of the correlation between RGB channels.And due to the use of convolutional neural network,it can effectively avoid the one-sidedness of artificial features.Experimental results have shown the scheme’s improvement over the state-of-the-art scheme on the accuracy of color image median filtering detection.展开更多
Network intrusion forensics is an important extension to present security infrastructure,and is becoming the focus of forensics research field.However,comparison with sophisticated multi-stage attacks and volume of se...Network intrusion forensics is an important extension to present security infrastructure,and is becoming the focus of forensics research field.However,comparison with sophisticated multi-stage attacks and volume of sensor data,current practices in network forensic analysis are to manually examine,an error prone,labor-intensive and time consuming process.To solve these problems,in this paper we propose a digital evidence fusion method for network forensics with Dempster-Shafer theory that can detect efficiently computer crime in networked environments,and fuse digital evidence from different sources such as hosts and sub-networks automatically.In the end,we evaluate the method on well-known KDD Cup1999 dataset.The results prove our method is very effective for real-time network forensics,and can provide comprehensible messages for a forensic investigators.展开更多
As a subversive concept,the metaverse has recently attracted widespread attention around the world and has set off a wave of enthusiasm in academic,industrial,and investment circles.However,while the metaverse brings ...As a subversive concept,the metaverse has recently attracted widespread attention around the world and has set off a wave of enthusiasm in academic,industrial,and investment circles.However,while the metaverse brings unprecedented opportunities for transformation to human society,it also contains related risks.Metaverse is a digital living space with information infrastructure,interoperability system,content production system,and value settlement system as the underlying structure in which the inner core is to connect real residents through applications and identities.Through social incentives and governance rules,the metaverse reflects the digital migration of human society.This article will conduct an in-depth analysis of the metaverse from the perspective of electronic data forensics.First,from the perspective of Internet development,the background and development process of the metaverse is discussed.By systematically elaborating on the concept and connotation of the metaverse,this paper summarizes the different views of current practitioners,experts,and scholars on the metaverse.Secondly,from the perspective of metaverse security,the social risk and crime risks of the metaverse are discussed.Then the importance of metaverse forensics is raised.Third,from the perspective of blockchain,smart wearable devices,and virtual reality devices,the objects and characteristics of metaverse forensics have been studied in depth.Taking smart wearable devices as an example,this paper gives the relevant experimental process of smart bracelet forensics.Finally,many challenges faced by metaverse forensics are summarized by us which provide readers with some exploratory guidance.展开更多
Digital forensics aims to uncover evidence of cybercrimes within compromised systems.These cybercrimes are often perpetrated through the deployment of malware,which inevitably leaves discernible traces within the comp...Digital forensics aims to uncover evidence of cybercrimes within compromised systems.These cybercrimes are often perpetrated through the deployment of malware,which inevitably leaves discernible traces within the compromised systems.Forensic analysts are tasked with extracting and subsequently analyzing data,termed as artifacts,from these systems to gather evidence.Therefore,forensic analysts must sift through extensive datasets to isolate pertinent evidence.However,manually identifying suspicious traces among numerous artifacts is time-consuming and labor-intensive.Previous studies addressed such inefficiencies by integrating artificial intelligence(AI)technologies into digital forensics.Despite the efforts in previous studies,artifacts were analyzed without considering the nature of the data within them and failed to prove their efficiency through specific evaluations.In this study,we propose a system to prioritize suspicious artifacts from compromised systems infected with malware to facilitate efficient digital forensics.Our system introduces a double-checking method that recognizes the nature of data within target artifacts and employs algorithms ideal for anomaly detection.The key ideas of this method are:(1)prioritize suspicious artifacts and filter remaining artifacts using autoencoder and(2)further prioritize suspicious artifacts and filter remaining artifacts using logarithmic entropy.Our evaluation demonstrates that our system can identify malicious artifacts with high accuracy and that its double-checking method is more efficient than alternative approaches.Our system can significantly reduce the time required for forensic analysis and serve as a reference for future studies.展开更多
In recent years,visual facial forgery has reached a level of sophistication that humans cannot identify fraud,which poses a significant threat to information security.A wide range of malicious applications have emerge...In recent years,visual facial forgery has reached a level of sophistication that humans cannot identify fraud,which poses a significant threat to information security.A wide range of malicious applications have emerged,such as deepfake,fake news,defamation or blackmailing of celebrities,impersonation of politicians in political warfare,and the spreading of rumours to attract views.As a result,a rich body of visual forensic techniques has been proposed in an attempt to stop this dangerous trend.However,there is no comprehensive,fair,and unified performance evaluation to enlighten the community on best performing methods.The authors present a systematic benchmark beyond traditional surveys that provides in-depth insights into facial forgery and facial forensics,grounding on robustness tests such as contrast,brightness,noise,resolution,missing information,and compression.The authors also provide a practical guideline of the benchmarking results,to determine the characteristics of the methods that serve as a comparative reference in this never-ending war between measures and countermeasures.The authors’source code is open to the public.展开更多
In this age when most organizations make use of cloud computing,it is important to not only protect cloud computing resources from cyber⁃attacks but also investigate these attacks.During forensic investigations in a c...In this age when most organizations make use of cloud computing,it is important to not only protect cloud computing resources from cyber⁃attacks but also investigate these attacks.During forensic investigations in a cloud environment,the investigators fall on service providers for pieces of evidence like log files.The challenge,however,is the integrity of these logs provided by the service providers.To this end,we propose a blockchain⁃based log verification system called BlogVerifier that uses a decentralized approach to solve forensics issues in the cloud.BlogVerifier extracts logs produced in cloud environments,hashes these logs and stores the hashed values as transactional values on the blockchain.The transactions are then merged into blocks and shared on the blockchain.The proposed system also ensures the continuation of an investigation even when the primary source of a log is compromised by using encryption and smart contracts.The proposed system also makes it possible for any stakeholder involved in the forensic process to verify the authenticity of log files.The performance results show that BlogVerifier can be integrated into the cloud environment without any significant impact on system resources and increase in computational cost.展开更多
With the development of Internet and information technology,the digital crimes are also on the rise.Computer forensics is an emerging research area that applies computer investigation and analysis techniques to help d...With the development of Internet and information technology,the digital crimes are also on the rise.Computer forensics is an emerging research area that applies computer investigation and analysis techniques to help detection of these crimes and gathering of digital evidence suitable for presentation in courts.This paper provides foundational concept of computer forensics,outlines various principles of computer forensics,discusses the model of computer forensics and presents a proposed model.展开更多
As a result of the many developments in information technology,digital evidence plays an increasingly important role in criminal and civil litigation.Because digital evidence is necessary for litigation,the judicial s...As a result of the many developments in information technology,digital evidence plays an increasingly important role in criminal and civil litigation.Because digital evidence is necessary for litigation,the judicial system must be assured of its accuracy,reliability,and verifiability,which can be assured by accreditation.This paper focuses on a comparison of the evolution of the accreditation of digital forensics internationally and domestically,discusses the existing problems that such accreditation encounters,and proposes the corresponding solutions.Moreover,this paper discusses the future of digital forensic laboratory accreditation and its implementation.展开更多
Since its birth in the early 90 's,digital forensics has been mainly focused on collecting and examining digital evidence from computers and networks that are controlled and owned by individuals or organizations.A...Since its birth in the early 90 's,digital forensics has been mainly focused on collecting and examining digital evidence from computers and networks that are controlled and owned by individuals or organizations.As cloud computing has recently emerged as a dominant platform for running applications and storing data,digital forensics faces well-known challenges in the cloud,such as data inaccessibility,data and service volatility,and law enforcement lacks control over the cloud.To date,very little research has been done to develop efficient theory and practice for digital forensics in the cloud.In this paper,we present a novel framework,Cloud Foren,which systematically addresses the challenges of forensics in cloud computing.Cloud Foren covers the entire process of digital forensics,from the initial point of complaint to the final point where the evidence is confirmed.The key components of Cloud Foren address some challenges,which are unique to the cloud.The proposed forensic process allows cloud forensic examiner,cloud provider,and cloud customer collaborate naturally.We use two case studies to demonstrate the applicability of Cloud Foren.We believe Cloud Foren holds great promise for more precise and automatic digital forensics in a cloud computing environment.展开更多
As a common medium in our daily life,images are important for most people to gather information.There are also people who edit or even tamper images to deliberately deliver false information under different purposes.T...As a common medium in our daily life,images are important for most people to gather information.There are also people who edit or even tamper images to deliberately deliver false information under different purposes.Thus,in digital forensics,it is necessary to understand the manipulating history of images.That requires to verify all possible manipulations applied to images.Among all the image editing manipulations,recoloring is widely used to adjust or repaint the colors in images.The color information is an important visual information that image can deliver.Thus,it is necessary to guarantee the correctness of color in digital forensics.On the other hand,many image retouching or editing applications or software are equipped with recoloring function.This enables ordinary people without expertise of image processing to apply recoloring for images.Hence,in order to secure the color information of images,in this paper,a recoloring detection method is proposed.The method is based on convolutional neural network which is quite popular in recent years.Unlike the traditional linear classifier,the proposed method can be employed for binary classification as well as multiple labels classification.The classification performance of different structure for the proposed architecture is also investigated in this paper.展开更多
In forensic investigations,it is vital that the authenticity of digital evidence should be ensured. In addition,technical means should be provided to ensure that digital evidence collected cannot be misused for the pu...In forensic investigations,it is vital that the authenticity of digital evidence should be ensured. In addition,technical means should be provided to ensure that digital evidence collected cannot be misused for the purpose of perjury. In this paper,we present a method to ensure both authenticity and non-misuse of data extracted from wireless mobile devices. In the method,the device ID and a timestamp become a part of the original data and the Hash function is used to bind the data together. Encryption is applied to the data,which includes the digital evidence,the device ID and the timestamp. Both symmetric and asymmetric encryption systems are employed in the proposed method where a random session key is used to encrypt the data while the public key of the forensic server is used to encrypt the session key to ensure security and efficiency. With the several security mechanisms that we show are supported or can be implemented in wireless mobile devices such as the Android,we can ensure the authenticity and non-misuse of data evidence in digital forensics.展开更多
Detecting hate speech automatically in social media forensics has emerged as a highly challenging task due tothe complex nature of language used in such platforms. Currently, several methods exist for classifying hate...Detecting hate speech automatically in social media forensics has emerged as a highly challenging task due tothe complex nature of language used in such platforms. Currently, several methods exist for classifying hatespeech, but they still suffer from ambiguity when differentiating between hateful and offensive content and theyalso lack accuracy. The work suggested in this paper uses a combination of the Whale Optimization Algorithm(WOA) and Particle Swarm Optimization (PSO) to adjust the weights of two Multi-Layer Perceptron (MLPs)for neutrosophic sets classification. During the training process of the MLP, the WOA is employed to exploreand determine the optimal set of weights. The PSO algorithm adjusts the weights to optimize the performanceof the MLP as fine-tuning. Additionally, in this approach, two separate MLP models are employed. One MLPis dedicated to predicting degrees of truth membership, while the other MLP focuses on predicting degrees offalse membership. The difference between these memberships quantifies uncertainty, indicating the degree ofindeterminacy in predictions. The experimental results indicate the superior performance of our model comparedto previous work when evaluated on the Davidson dataset.展开更多
The integrity and fidelity of digital evidence are very important in live forensics. Previous studies have focused the uncertainty of live forensics based on different memory snapshots. However,this kind of method is ...The integrity and fidelity of digital evidence are very important in live forensics. Previous studies have focused the uncertainty of live forensics based on different memory snapshots. However,this kind of method is not effective in practice. In fact,memory images are usually acquired by using forensics tools instead of using snapshots. Therefore,the integrity and fidelity of live evidence should be evaluated during the acquisition process. In this paper,we study the problem in a novel viewpoint. Firstly,several definitions about memory acquisition measure error are introduced to describe the trusty. Then,we analyze the experimental error and propose some suggestions on how to reduce it. A novel method is also developed to calculate the system error in detail. The results of a case study on Windows 7 and VMware virtual machine show that the experimental error has good accuracy and precision,which demonstrate the efficacy of the proposed reducing methods. The system error is also evaluated,that is,it accounts for the whole error from 30% to 50%.展开更多
基金supported by the National Fund Cultivation Project from China People’s Police University(Grant Number:JJPY202402)National Natural Science Foundation of China(Grant Number:62172165).
摘要With the rapid advancement of visual generative models such as Generative Adversarial Networks(GANs)and stable Diffusion,the creation of highly realistic Deepfake through automated forgery has significantly progressed.This paper examines the advancements inDeepfake detection and defense technologies,emphasizing the shift from passive detection methods to proactive digital watermarking techniques.Passive detection methods,which involve extracting features from images or videos to identify forgeries,encounter challenges such as poor performance against unknown manipulation techniques and susceptibility to counter-forensic tactics.In contrast,proactive digital watermarking techniques embed specificmarkers into images or videos,facilitating real-time detection and traceability,thereby providing a preemptive defense againstDeepfake content.We offer a comprehensive analysis of digitalwatermarking-based forensic techniques,discussing their advantages over passivemethods and highlighting four key benefits:real-time detection,embedded defense,resistance to tampering,and provision of legal evidence.Additionally,the paper identifies gaps in the literature concerning proactive forensic techniques and suggests future research directions,including cross-domain watermarking and adaptive watermarking strategies.By systematically classifying and comparing existing techniques,this review aims to contribute valuable insights for the development of more effective proactive defense strategies in Deepfake forensics.
基金supported in part by Natural Science Foundation of Hubei Province of China under Grant 2023AFB016the 2022 Opening Fund for Hubei Key Laboratory of Intelligent Vision Based Monitoring for Hydroelectric Engineering under Grant 2022SDSJ02the Construction Fund for Hubei Key Laboratory of Intelligent Vision Based Monitoring for Hydroelectric Engineering under Grant 2019ZYYD007.
摘要Images and videos play an increasingly vital role in daily life and are widely utilized as key evidentiary sources in judicial investigations and forensic analysis.Simultaneously,advancements in image and video processing technologies have facilitated the widespread availability of powerful editing tools,such as Deepfakes,enabling anyone to easily create manipulated or fake visual content,which poses an enormous threat to social security and public trust.To verify the authenticity and integrity of images and videos,numerous approaches have been proposed,which are primarily based on content analysis and their effectiveness is susceptible to interference from various image or video post-processing operations.Recent research has highlighted the potential of file containers analysis as a promising forensic approach that offers efficient and interpretable results.However,there is still a lack of review articles on this kind of approach.In order to fill this gap,we present a comprehensive review of file containers-based image and video forensics in this paper.Specifically,we categorize the existing methods into two distinct stages,qualitative analysis and quantitative analysis.In addition,an overall framework is proposed to organize the exiting approaches.Then,the advantages and disadvantages of the schemes used across different forensic tasks are provided.Finally,we outline the trends in this research area,aiming to provide valuable insights and technical guidance for future research.
基金This research was supported by the Korea Institute for Advancement of Technology(KIAT)Grant Funded by the Korea Government(MOTIE)(P0012724,The Competency Development Program for Industry Specialist)and the Soonchunhyang University Research Fund.
摘要In this research,we developed a plugin for our automated digital forensics framework to extract and preserve the evidence from the Android and the IOS-based mobile phone application,Instagram.This plugin extracts personal details from Instagram users,e.g.,name,user name,mobile number,ID,direct text or audio,video,and picture messages exchanged between different Instagram users.While developing the plugin,we identified resources available in both Android and IOS-based devices holding key forensics artifacts.We highlighted the poor privacy scheme employed by Instagram.This work,has shown how the sensitive data posted in the Instagram mobile application can easily be reconstructed,and how the traces,as well as the URL links of visual messages,can be used to access the privacy of any Instagram user without any critical credential verification.We also employed the anti-forensics method on the Instagram Android’s application and were able to restore the application from the altered or corrupted database file,which any criminal mind can use to set up or trap someone else.The outcome of this research is a plugin for our digital forensics ready framework software which could be used by law enforcement and regulatory agencies to reconstruct the digital evidence available in the Instagram mobile application directories on both Android and IOS-based mobile phones.
基金supported by Basic Science Research Program through the National Research Foundation of Korea(NRF)funded by the Ministry of Education(2021R1I1A3049788).
摘要In today’s digital era,the rapid evolution of image editing technologies has brought about a significant simplification of image manipulation.Unfortunately,this progress has also given rise to the misuse of manipulated images across various domains.One of the pressing challenges stemming from this advancement is the increasing difficulty in discerning between unaltered and manipulated images.This paper offers a comprehensive survey of existing methodologies for detecting image tampering,shedding light on the diverse approaches employed in the field of contemporary image forensics.The methods used to identify image forgery can be broadly classified into two primary categories:classical machine learning techniques,heavily reliant on manually crafted features,and deep learning methods.Additionally,this paper explores recent developments in image forensics,placing particular emphasis on the detection of counterfeit colorization.Image colorization involves predicting colors for grayscale images,thereby enhancing their visual appeal.The advancements in colorization techniques have reached a level where distinguishing between authentic and forged images with the naked eye has become an exceptionally challenging task.This paper serves as an in-depth exploration of the intricacies of image forensics in the modern age,with a specific focus on the detection of colorization forgery,presenting a comprehensive overview of methodologies in this critical field.
摘要The smart home platform integrates with Internet of Things(IoT)devices,smartphones,and cloud servers,enabling seamless and convenient services.It gathers and manages extensive user data,including personal information,device operations,and patterns of user behavior.Such data plays an essential role in criminal inves-tigations,highlighting the growing importance of specialized smart home forensics.Given the rapid advancement in smart home software and hardware technologies,many companies are introducing new devices and services that expand the market.Consequently,scalable and platform-specific forensic research is necessary to support efficient digital investigations across diverse smart home ecosystems.This study thoroughly examines the core components and structures of smart homes,proposing a generalized architecture that represents various operational environments.A three-stage smart home forensics framework is introduced:(1)analyzing application functions to infer relevant data,(2)extracting and processing data from interconnected devices,and(3)identifying data valuable for investigative purposes.The framework’s applicability is validated using testbeds from Samsung SmartThings and Xiaomi Mi Home platforms,offering practical insights for real-world forensic applications.The results demonstrate that the proposed forensic framework effectively acquires and classifies relevant digital evidence in smart home platforms,confirming its practical applicability in smart home forensic investigations.
摘要Second level dactyloscopic markants(minutiae)are irregularities in the course of the friction ridge skin used for personal identification because of their high variability.Individual uniqueness is affected by the high number of minutiae and their random distribution within the friction ridge skin.The combination of various environmental factors,e.g.,snow,soil environment,and direct sunlight,can affect the quality of fingerprints.The aim of this study was to analyze the influence of snow under two different conditions(natural snowfall and immersion in the snow)within various time intervals on fingerprints.A total of 265 groomed latent distal fingerprints were taken from a Caucasian male from Slovakia.Latent fingerprints were taken only from one participant,as the composition of sweat,i.e.,the sweat-fat substance,varies from person to person,which could influence the results.Subsequently,obtained latent fingerprints were developed using small particle reagent.We evaluated the decrease in the number of minutiae on latent fingerprints exposed to the destructive influence of snow.The results confirmed that snow has a significant effect on the quality of latent fingerprints,as a decrease in the average number of minutiae on latent prints was observed after only 2 h of exposure to snow conditions.After snow exposure,usable fingerprints for identification decreased,whilst non-usable ones increased,with 53.33%of non-usable fingerprints resulting from natural snowfall exposure.After exposure of latent fingerprints to snow immersion,98.13%of non-usable fingerprints were found.The results can help improving personal identification efficiency.
基金supported by NSFC(No.61702429)Sichuan Science and Technology Program(No.19yyjc1656).
摘要The multi-purpose forensics is an important tool for forge image detection.In this paper,we propose a universal feature set for the multi-purpose forensics which is capable of simultaneously identifying several typical image manipulations,including spatial low-pass Gaussian blurring,median filtering,re-sampling,and JPEG compression.To eliminate the influences caused by diverse image contents on the effectiveness and robustness of the feature,a residual group which contains several high-pass filtered residuals is introduced.The partial correlation coefficient is exploited from the residual group to purely measure neighborhood correlations in a linear way.Besides that,we also combine autoregressive coefficient and transition probability to form the proposed composite feature which is used to measure how manipulations change the neighborhood relationships in both linear and non-linear way.After a series of dimension reductions,the proposed feature set can accelerate the training and testing for the multi-purpose forensics.The proposed feature set is then fed into a multi-classifier to train a multi-purpose detector.Experimental results show that the proposed detector can identify several typical image manipulations,and is superior to the complicated deep CNN-based methods in terms of detection accuracy and time efficiency for JPEG compressed image with low resolution.
基金The work was supported in part by the Natural Science Foundation of China under Grants(Nos.61772281,61502241,61272421,61232016,61402235 and 61572258)in part by the Natural Science Foundation of Jiangsu Province,China under Grant BK20141006+1 种基金in part by the Natural Science Foundation of the Universities in Jiangsu Province under Grant 14KJB520024the PAPD fund and the CICAEET fund.
摘要In the paper,a convolutional neural network based on quaternion transformation is proposed to detect median filtering for color images.Compared with conventional convolutional neural network,color images can be processed in a holistic manner in the proposed scheme,which makes full use of the correlation between RGB channels.And due to the use of convolutional neural network,it can effectively avoid the one-sidedness of artificial features.Experimental results have shown the scheme’s improvement over the state-of-the-art scheme on the accuracy of color image median filtering detection.
基金supported by the National Natural Science Foundation of China under Grant No.60903166 the National High Technology Research and Development Program of China(863 Program) under Grants No.2012AA012506,No.2012AA012901,No.2012AA012903+9 种基金 Specialized Research Fund for the Doctoral Program of Higher Education of China under Grant No.20121103120032 the Humanity and Social Science Youth Foundation of Ministry of Education of China under Grant No.13YJCZH065 the Opening Project of Key Lab of Information Network Security of Ministry of Public Security(The Third Research Institute of Ministry of Public Security) under Grant No.C13613 the China Postdoctoral Science Foundation General Program of Science and Technology Development Project of Beijing Municipal Education Commission of China under Grant No.km201410005012 the Research on Education and Teaching of Beijing University of Technology under Grant No.ER2013C24 the Beijing Municipal Natural Science Foundation Sponsored by Hunan Postdoctoral Scientific Program Open Research Fund of Beijing Key Laboratory of Trusted Computing Funds for the Central Universities, Contract No.2012JBM030
摘要Network intrusion forensics is an important extension to present security infrastructure,and is becoming the focus of forensics research field.However,comparison with sophisticated multi-stage attacks and volume of sensor data,current practices in network forensic analysis are to manually examine,an error prone,labor-intensive and time consuming process.To solve these problems,in this paper we propose a digital evidence fusion method for network forensics with Dempster-Shafer theory that can detect efficiently computer crime in networked environments,and fuse digital evidence from different sources such as hosts and sub-networks automatically.In the end,we evaluate the method on well-known KDD Cup1999 dataset.The results prove our method is very effective for real-time network forensics,and can provide comprehensible messages for a forensic investigators.
基金supported by 2021 Jiangsu Police Institute Scientific Research Project(2021SJYZK01)High-Level Introduction of Talent Scientific Research Start-Up Fund of Jiangsu Police Institute(JSPI19GKZL407)+2 种基金Jiangsu Provincial Department of Public Security Science and Technology Project(2021KX012)Open Project of Criminal Inspection Laboratory in Key Laboratories of Sichuan Provincial Universities(2023YB03)Major Project of Basic Science(Natural Science)Research in Higher Education Institutions in Jiangsu Province(2020232001),2023‘Jiangsu Science and Technology Think Tank Youth Talent Plan’.
摘要As a subversive concept,the metaverse has recently attracted widespread attention around the world and has set off a wave of enthusiasm in academic,industrial,and investment circles.However,while the metaverse brings unprecedented opportunities for transformation to human society,it also contains related risks.Metaverse is a digital living space with information infrastructure,interoperability system,content production system,and value settlement system as the underlying structure in which the inner core is to connect real residents through applications and identities.Through social incentives and governance rules,the metaverse reflects the digital migration of human society.This article will conduct an in-depth analysis of the metaverse from the perspective of electronic data forensics.First,from the perspective of Internet development,the background and development process of the metaverse is discussed.By systematically elaborating on the concept and connotation of the metaverse,this paper summarizes the different views of current practitioners,experts,and scholars on the metaverse.Secondly,from the perspective of metaverse security,the social risk and crime risks of the metaverse are discussed.Then the importance of metaverse forensics is raised.Third,from the perspective of blockchain,smart wearable devices,and virtual reality devices,the objects and characteristics of metaverse forensics have been studied in depth.Taking smart wearable devices as an example,this paper gives the relevant experimental process of smart bracelet forensics.Finally,many challenges faced by metaverse forensics are summarized by us which provide readers with some exploratory guidance.
基金supported by the MSIT(Ministry of Science and ICT),Korea,under the ITRC(Information Technology Research Center)support program(IITP-2024-RS-2024-00437494)supervised by the IITP(Institute for Information&Communications Technology Planning&Evaluation).
摘要Digital forensics aims to uncover evidence of cybercrimes within compromised systems.These cybercrimes are often perpetrated through the deployment of malware,which inevitably leaves discernible traces within the compromised systems.Forensic analysts are tasked with extracting and subsequently analyzing data,termed as artifacts,from these systems to gather evidence.Therefore,forensic analysts must sift through extensive datasets to isolate pertinent evidence.However,manually identifying suspicious traces among numerous artifacts is time-consuming and labor-intensive.Previous studies addressed such inefficiencies by integrating artificial intelligence(AI)technologies into digital forensics.Despite the efforts in previous studies,artifacts were analyzed without considering the nature of the data within them and failed to prove their efficiency through specific evaluations.In this study,we propose a system to prioritize suspicious artifacts from compromised systems infected with malware to facilitate efficient digital forensics.Our system introduces a double-checking method that recognizes the nature of data within target artifacts and employs algorithms ideal for anomaly detection.The key ideas of this method are:(1)prioritize suspicious artifacts and filter remaining artifacts using autoencoder and(2)further prioritize suspicious artifacts and filter remaining artifacts using logarithmic entropy.Our evaluation demonstrates that our system can identify malicious artifacts with high accuracy and that its double-checking method is more efficient than alternative approaches.Our system can significantly reduce the time required for forensic analysis and serve as a reference for future studies.
基金QuỹĐổi mới sáng tạo Vingroup,Grant/Award Number:VINIF.2020.ThS.BK.10。
摘要In recent years,visual facial forgery has reached a level of sophistication that humans cannot identify fraud,which poses a significant threat to information security.A wide range of malicious applications have emerged,such as deepfake,fake news,defamation or blackmailing of celebrities,impersonation of politicians in political warfare,and the spreading of rumours to attract views.As a result,a rich body of visual forensic techniques has been proposed in an attempt to stop this dangerous trend.However,there is no comprehensive,fair,and unified performance evaluation to enlighten the community on best performing methods.The authors present a systematic benchmark beyond traditional surveys that provides in-depth insights into facial forgery and facial forensics,grounding on robustness tests such as contrast,brightness,noise,resolution,missing information,and compression.The authors also provide a practical guideline of the benchmarking results,to determine the characteristics of the methods that serve as a comparative reference in this never-ending war between measures and countermeasures.The authors’source code is open to the public.
基金National Natural Science Foundation of China(No.61602109)Distinguished Young Professor Program of Donghua University,China(No.LZB2019003)+1 种基金Shanghai Science and Technology Innovation Action Plan,China(No.19511101802)Fundamental Research Funds for the Central Universities。
摘要In this age when most organizations make use of cloud computing,it is important to not only protect cloud computing resources from cyber⁃attacks but also investigate these attacks.During forensic investigations in a cloud environment,the investigators fall on service providers for pieces of evidence like log files.The challenge,however,is the integrity of these logs provided by the service providers.To this end,we propose a blockchain⁃based log verification system called BlogVerifier that uses a decentralized approach to solve forensics issues in the cloud.BlogVerifier extracts logs produced in cloud environments,hashes these logs and stores the hashed values as transactional values on the blockchain.The transactions are then merged into blocks and shared on the blockchain.The proposed system also ensures the continuation of an investigation even when the primary source of a log is compromised by using encryption and smart contracts.The proposed system also makes it possible for any stakeholder involved in the forensic process to verify the authenticity of log files.The performance results show that BlogVerifier can be integrated into the cloud environment without any significant impact on system resources and increase in computational cost.
基金This paper is supported by the Special Basic Research,Ministry of Science and Technology of the People's Republic of China,project number:2008FY240200Science and Technology Com-mission of Shanghai Municipality,project number:09dz1501203and The Ministry of Public Security of the People's Republic of China,project number:2009ZDYJGASS026.
摘要With the development of Internet and information technology,the digital crimes are also on the rise.Computer forensics is an emerging research area that applies computer investigation and analysis techniques to help detection of these crimes and gathering of digital evidence suitable for presentation in courts.This paper provides foundational concept of computer forensics,outlines various principles of computer forensics,discusses the model of computer forensics and presents a proposed model.
基金supported by grants from the National Key Research and Development Program of China[grant number 2016YFC0800705]the Shanghai Forensic Service Platform[grant number 16DZ2290900]the Shanghai Key Laboratory of Forensic Medicine[grant number 17DZ2273200].
摘要As a result of the many developments in information technology,digital evidence plays an increasingly important role in criminal and civil litigation.Because digital evidence is necessary for litigation,the judicial system must be assured of its accuracy,reliability,and verifiability,which can be assured by accreditation.This paper focuses on a comparison of the evolution of the accreditation of digital forensics internationally and domestically,discusses the existing problems that such accreditation encounters,and proposes the corresponding solutions.Moreover,this paper discusses the future of digital forensic laboratory accreditation and its implementation.
摘要Since its birth in the early 90 's,digital forensics has been mainly focused on collecting and examining digital evidence from computers and networks that are controlled and owned by individuals or organizations.As cloud computing has recently emerged as a dominant platform for running applications and storing data,digital forensics faces well-known challenges in the cloud,such as data inaccessibility,data and service volatility,and law enforcement lacks control over the cloud.To date,very little research has been done to develop efficient theory and practice for digital forensics in the cloud.In this paper,we present a novel framework,Cloud Foren,which systematically addresses the challenges of forensics in cloud computing.Cloud Foren covers the entire process of digital forensics,from the initial point of complaint to the final point where the evidence is confirmed.The key components of Cloud Foren address some challenges,which are unique to the cloud.The proposed forensic process allows cloud forensic examiner,cloud provider,and cloud customer collaborate naturally.We use two case studies to demonstrate the applicability of Cloud Foren.We believe Cloud Foren holds great promise for more precise and automatic digital forensics in a cloud computing environment.
摘要As a common medium in our daily life,images are important for most people to gather information.There are also people who edit or even tamper images to deliberately deliver false information under different purposes.Thus,in digital forensics,it is necessary to understand the manipulating history of images.That requires to verify all possible manipulations applied to images.Among all the image editing manipulations,recoloring is widely used to adjust or repaint the colors in images.The color information is an important visual information that image can deliver.Thus,it is necessary to guarantee the correctness of color in digital forensics.On the other hand,many image retouching or editing applications or software are equipped with recoloring function.This enables ordinary people without expertise of image processing to apply recoloring for images.Hence,in order to secure the color information of images,in this paper,a recoloring detection method is proposed.The method is based on convolutional neural network which is quite popular in recent years.Unlike the traditional linear classifier,the proposed method can be employed for binary classification as well as multiple labels classification.The classification performance of different structure for the proposed architecture is also investigated in this paper.
基金Sponsored by Shandong Natural Science Foundation-Youth Found Project(Grant No.ZR2013FQ024)the Opening Project of State Key Laboratory of Digital Publishing Technology
摘要In forensic investigations,it is vital that the authenticity of digital evidence should be ensured. In addition,technical means should be provided to ensure that digital evidence collected cannot be misused for the purpose of perjury. In this paper,we present a method to ensure both authenticity and non-misuse of data extracted from wireless mobile devices. In the method,the device ID and a timestamp become a part of the original data and the Hash function is used to bind the data together. Encryption is applied to the data,which includes the digital evidence,the device ID and the timestamp. Both symmetric and asymmetric encryption systems are employed in the proposed method where a random session key is used to encrypt the data while the public key of the forensic server is used to encrypt the session key to ensure security and efficiency. With the several security mechanisms that we show are supported or can be implemented in wireless mobile devices such as the Android,we can ensure the authenticity and non-misuse of data evidence in digital forensics.
摘要Detecting hate speech automatically in social media forensics has emerged as a highly challenging task due tothe complex nature of language used in such platforms. Currently, several methods exist for classifying hatespeech, but they still suffer from ambiguity when differentiating between hateful and offensive content and theyalso lack accuracy. The work suggested in this paper uses a combination of the Whale Optimization Algorithm(WOA) and Particle Swarm Optimization (PSO) to adjust the weights of two Multi-Layer Perceptron (MLPs)for neutrosophic sets classification. During the training process of the MLP, the WOA is employed to exploreand determine the optimal set of weights. The PSO algorithm adjusts the weights to optimize the performanceof the MLP as fine-tuning. Additionally, in this approach, two separate MLP models are employed. One MLPis dedicated to predicting degrees of truth membership, while the other MLP focuses on predicting degrees offalse membership. The difference between these memberships quantifies uncertainty, indicating the degree ofindeterminacy in predictions. The experimental results indicate the superior performance of our model comparedto previous work when evaluated on the Davidson dataset.
基金Sponsored by the National Natural Science Foundation of China (Grant No.61303199)Natural Science Foundation of Shandong Province (Grant No.ZR2013FQ001 and ZR2011FQ030)+1 种基金Outstanding Research Award Fund for Young Scientists of Shandong Province,China (Grant No.BS2013DX010)Academy of Sciences Youth Fund Project of Shandong Province (Grant No.2013QN007)
摘要The integrity and fidelity of digital evidence are very important in live forensics. Previous studies have focused the uncertainty of live forensics based on different memory snapshots. However,this kind of method is not effective in practice. In fact,memory images are usually acquired by using forensics tools instead of using snapshots. Therefore,the integrity and fidelity of live evidence should be evaluated during the acquisition process. In this paper,we study the problem in a novel viewpoint. Firstly,several definitions about memory acquisition measure error are introduced to describe the trusty. Then,we analyze the experimental error and propose some suggestions on how to reduce it. A novel method is also developed to calculate the system error in detail. The results of a case study on Windows 7 and VMware virtual machine show that the experimental error has good accuracy and precision,which demonstrate the efficacy of the proposed reducing methods. The system error is also evaluated,that is,it accounts for the whole error from 30% to 50%.