Social network forensics aims to collect and analyze social media user information and communication content. When people communicate through messages, phone calls, emails, and social media platforms, they leave various records on their devices and the Internet, forming a huge social network. Community detection can help investigators analyze group leaders and community structure, which is significant to case investigation and crime control. This paper proposes an unsupervised community detection framework based on GCN (Graph Convolution Network). Our main idea is to utilize social network topology and social network communication content to construct user features. The proposed end-to-end community detection framework can display the social network topology, locate the core members of the community, and show the connections between users. We evaluate our framework on the Enron email dataset. Experimental results show that our model outperforms unsupervised benchmark methods. We also concluded that the community detection framework should be able to analyze social networks, enabling forensic investigators to reveal connections between people.

Deepfake brings huge and potential negative impacts to our daily lives. As the real-life Deepfake videos circulated on the Internet become more authentic, most existing detection algorithms have failed since few visual differences can be observed between an authentic video and a Deepfake one. However, the forensic traces are always retained within the synthesized videos. In this study, we present a noise-based Deepfake detection model, NoiseDF for short, which focuses on the underlying forensic noise traces left behind the Deepfake videos. In particular, we enhance the RIDNet denoiser to extract noise traces and features from the cropped face and background squares of the video image frames. Meanwhile, we devise a novel Multi-Head Relative-Interaction method to evaluate the degree of interaction between the faces and backgrounds that plays a pivotal role in the Deepfake detection task. Besides outperforming the state-of-the-art models, the visualization of the extracted Deepfake forensic noise traces has further displayed the evidence and proved the robustness of our approach.

Recently, Deepfake has drawn considerable public attention due to security and privacy concerns in social media digital forensics. As the wildly spreading Deepfake videos on the Internet become more realistic, traditional detection techniques have failed in distinguishing between real and fake. Most existing deep learning methods mainly focus on local features and relations within the face image using convolutional neural networks as a backbone. However, local features and relations are insufficient for model training to learn enough general information for Deepfake detection. Therefore, the existing Deepfake detection methods have reached a bottleneck to further improve the detection performance. To address this issue, we propose a deep convolutional Transformer to incorporate the decisive image features both locally and globally. Specifically, we apply convolutional pooling and re-attention to enrich the extracted features and enhance efficacy. Moreover, we employ the barely discussed image keyframes in model training for performance improvement and visualize the feature quantity gap between the key and normal image frames caused by video compression. We finally illustrate the transferability with extensive experiments on several Deepfake benchmark datasets. The proposed solution consistently outperforms several state-of-the-art baselines on both within- and cross-dataset experiments.

Threat intelligence, information about potential or current attacks to an organization, is an important component in cyber security territory. As new threats consecutively occurring, cyber security professionals always keep an eye on the latest threat intelligence in order to continuously lower the security risks for their organizations. Cyber threat intelligence is usually conveyed by structured data like CVE entities and unstructured data like articles and reports. Structured data are always under certain patterns that can be easily analyzed, while unstructured data have more difficulties to find fixed patterns to analyze. There exists plenty of methods and algorithms on information extraction from structured data, but no current work is complete or suitable for semantics extraction upon unstructured cyber threat intelligence data. In this paper, we introduce an idea of automatic tagging applying JAPE feature within GATE framework to perform semantics extraction upon cyber threat intelligence unstructured data such as articles and reports. We extract token entities from each cyber threat intelligence article or report and evaluate the usefulness of them. A threat intelligence ontology then can be constructed with the useful entities extracted from related resources and provide convenience for professionals to find latest useful threat intelligence they need.

DDoS attack is still one of the major threats from Internet. We propose a new technique to mitigate different types of DDoS, combining and taking advantages of both machine learning algorithms and Bloom filter. We use machine learning to extract features of attacks, then use a customized Bloom filter to defend attacks based on selected features. We implemented and tested the performance of the proposed technique in a lab environment.

Min Yang, Wenting Tu, Ziyu Lu, Wenpeng Yin, Kam-Pui Chow. Proceedings of the 2015 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. 2015.

Analyzing and understanding people's sentiments towards different topics has become an interesting task due to the explosion of opinion-rich resources. In most sentiment analysis applications, sentiment lexicons play a crucial role, to be used as metadata of sentiment polarity. However, most previous works focus on discovering general-purpose sentiment lexicons. They cannot capture domain-specific sentiment words, or implicit and connotative sentiment words that are seemingly objective. In this paper, we propose a supervised sentiment-aware LDA model (ssLDA). The model uses a minimal set of domain-independent seed words and document labels to discover a domain-specific lexicon, learning a lexicon much richer and adaptive to the sentiment of specific document. Experiments on two publicly-available datasets (movie reviews and Obama-McCain debate dataset) show that our model is effective in constructing a comprehensive and high-quality domain-specific sentiment lexicon. Furthermore, the resulting lexicon significantly improves the performance of sentiment classification tasks.

The concept of legal professional privilege (LPP) in the Common Law is to enable a client to make full disclosure to his legal advisor for seeking advice without worrying that anything so disclosed will be used against him. Thus, some of the communications and documents between a legal advisor and his client can be excluded as evidence for prosecution. Protection of LPP information in the physical world is well addressed and proper procedures for handling LPP documents have been established. However, there does not exist a forensically sound procedure for protecting digital LPP information. In this correspondence, motivated by a real case of a commercial crime investigation, we introduce the LPP data integrity problem. While finding an ideal solution to solve the problem is difficult, we propose a practical solution that was adopted to solve the real case investigation. We also analyze the performance of our solution based on simulated data.

Verifying the integrity of a hard disk is an important concern in computer forensics, as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation. A typical approach is to compute a single chained hash value of all sectors in a specific order. However, this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified intentionally. In this paper we propose a k -dimensional hashing scheme, k D for short, to distribute sectors into a k D space, and to calculate multiple hash values for sectors in k dimensions as integrity evidence. Since the integrity of the sectors can be verified depending on any hash value calculated using the sectors, the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard disk. We show how to efficiently implement this k D hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified successfully. Experimental results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable.

An operational complexity model (OCM) is proposed to enable the complexity of both the cognitive and the computational components of a process to be determined. From the complexity of formation of a set of traces via a specified route a measure of the probability of that route can be determined. By determining the complexities of alternative routes leading to the formation of the same set of traces, the odds ratio indicating the relative plausibility of the alternative routes can be found. An illustrative application to a BitTorrent piracy case is presented, and the results obtained suggest that the OCM is capable of providing a realistic estimate of the odds ratio for two competing hypotheses. It is also demonstrated that the OCM can be straightforwardly refined to encompass a variety of circumstances.

This paper proposes a novel face texture mapping framework to transform faces with different poses into a unique texture map. Under this framework, texture mapping can be realized by utilizing a generic 3D face model, standard Haar-like feature based detector, active appearance model and pose estimation algorithm. By this texture map, correspondence of every pixel at the face across multiple distinct input images can then be established, which enables super-resolution algorithms to be applied directly on registered texture map to render high resolution faces. This paper details the proposed framework, and illustrates how the proposed super-resolution algorithm works with the help of weighted average and median filters. Convincing experimental results are also presented to validate the effectiveness of the proposed framework and super-resolution algorithm.

The Internet and computers did not invent or even cause privacy issues. The issues existed long before the creation of computers and Internet. The existence of the Internet, computers and large data storage make it possible to collect, process and transmit large volumes of data, including personal data. In this paper, we shall study the privacy from following two different views, namely legal framework and computer security model, and attempt to identify the difference between them. Because of the difference, we further argue that the current computer security model is not sufficient to support the privacy requirements in the legal framework. We propose a computer model ¿privacy reference monitor¿ to handle those unsupported requirements. The design of the privacy reference monitor is privacy policy neutral with a small number of functions. With minimal functionalities, we believe that it is possible to implement a verifiable privacy reference monitor.

In this paper, we present the design, the implementation details, and the evaluation results of an intrusion detection and defense system for distributed denial-of-service (DDoS) attack. The evaluation is conducted using an experimental testbed. The system, known as intrusion detection router (IDR), is deployed on network routers to perform online detection on any DDoS attack event, and then react with defense mechanisms to mitigate the attack. The testbed is built up by a cluster of sufficient number of Linux machines to mimic a portion of the Internet. Using the testbed, we conduct real experiments to evaluate the IDR system and demonstrate that IDR is effective in protecting the network from various DDoS attacks.

To provide secure communication for mobile devices, an authenticated key agreement protocol is an important primitive for establishing session keys. However, most existing authenticated key agreement protocols are not designed for wireless mobile communication for which bandwidth and device storage capacity are limited. Also, as mobile devices are more vulnerable to attack, providing forward secrecy becomes an essential element in the protocol. Based on Seo and Sweeney's simple authenticated key agreement algorithm (SAKA), we develop an improved authenticated key agreement protocol that eliminates the disadvantages of SAKA and provides identity authentication, key validation, and perfect forward secrecy. Also, our protocol can foil man-in-the-middle attacks. We also show how our proposed protocol can be included in the current 3GPP2 specifications for OTASP to improve A-key (authentication key) distribution, which is the master key in IS-95 and cdma2000 mobile networks. The proposed protocol requires significantly less bandwidth, and less computational and storage overhead, while having higher security compared to 3GPP2 specifications. The proposed protocol can also be applied to other wireless communication scenarios.

As electronic commerce becomes increasingly popular, more business data are being stored in digital form and processed by software systems, rather than being stored in paper form and handled by human beings. Consequently, loss of company secrets via the electronic media is becoming a greater threat to organizations. This paper gives a brief analysis of the risk associated with losing corporate confidential information in electronic form

Concerns the design and performance of the telephone directory enquiry system that has been newly adopted in Hong Kong. This system maintains three million telephone records and supports over 40,000 enquiries per hour at the peak. In Hong Kong society, the uses of English and Chinese (in particular, Cantonese) has been blending in a thrust of exciting language culture, giving rise to a variety of telephone enquires that traditional B-tree or hashing-based telephone directory enquiry systems fail to handle. The efficiency and flexibility achieved by the new system stem from hosting all indexing data structures in the main memory; these data structures occupy about half a giga-byte and would have been considered too expensive to be placed in main memory in the past.