In recent years, artificial intelligence (AI) has significantly impacted digital forensics, yet its broader deployment remains limited due to the difficulty of explaining AI decisions. Explainable AI (XAI) presents a promising solution to increase transparency and trust, but its application in digital forensics is still underexplored. In this work, we present a practical and structured explainable digital forensics AI (xDFAI) approach tailored to the forensic task of video source camera identification (VSCI). Our method enables forensic examiners to interpret the behavior of AI models, assess whether decisions are driven by intended logic or arise from random or content-dependent artifacts, and establish the integrity and reliability of explanations. We implement and evaluate this approach on two state-of-the-art VSCI models, providing step-by-step analysis of explanation quality, spatial consistency of high-impact features, and content dependence. Our results reveal that although models achieve strong classification accuracy, their explanations lack spatial stability and are impacted by video content, raising concerns about forensic reliability. To support reproducibility and future research, we provide an open-source implementation. This work underscores the potential of XAI to improve transparency in digital forensics and highlights the challenges of interpreting and presenting results. Our study takes an important step toward the operational deployment of xDFAI in multimedia forensics.

As cryptocurrencies have become increasingly used as an alternative to regular cash and credit card payments, the wallet solutions/apps that facilitate their use have also become increasingly popular. This has also intensified the involvement of these crypto wallet apps in criminal activities such as ransom requests, money laundering, and transactions on dark markets. From a digital forensics point of view, it is crucial to have tools and reliable approaches to detect these wallets on devices and extract their artifacts quickly with greater efficiency. However, with current research and trends, forensic investigators still need to manually extract these file artifacts, which delays the time-sensitive investigation findings. As mobile devices increasingly facilitate cryptocurrency transactions, there emerges a critical gap and need for automated evidence extraction to detect crucial artifacts preventing illicit activities. Therefore, in this paper, we present a comprehensive framework that incorporates various machine learning (ML), image processing, and natural language processing (NLP) approaches to enable fast and automated extraction/triage of crypto-related artifacts from Android and iOS devices. Specifically, our method can automatically detect which crypto wallet exists on the device, their artifacts (i.e., database/log files), along with the crypto-related images, web browsing data, and SMS conversations. For each type of data, we offer a specific ML technique, such as Support Vector Machine, Logistic Regression, and Neural Networks, to detect and classify these files. Our evaluation results show very high accuracy compared to alternative tools: our wallet classification model achieves 91% recall, crypto-related image classification achieves 75% accuracy, browsing data achieves 100% accuracy, and the SMS message model achieves 85% accuracy.

The number of applications of unmanned aerial vehicles (UAVs) (aka drones) is rapidly expanding. However, the wireless and broadcast nature of communications between the drones and their operators (i.e., Ground control station (GCS)) presents a risk for this channel to be exploited by outsiders. Specifically, an attacker can abuse benign communications as a cover to leak sensitive drone data secretly to nearby adversaries within the transmission range of a drone. Therefore, in this paper, we investigate the threat of information leakage through MAVLink, a drone control protocol that is widely used in the majority of drone autopilot systems and is considered a de-facto standard. We show that multiple covert channels can be created in MAVLink by exploiting its lack of security mechanisms, default broadcast messages, and redundant features. We design and implement the novel covert channels on a realistic drone testbed in practical settings and assess their feasibility. Our extensive results demonstrate that attackers can effectively exfiltrate different types of sensitive data from drones with a high throughput via MAVLink-based covert channels in the presence of an active warden at the GCS. Finally, we provide an in-depth analysis of several countermeasures for MAVLink-based covert channels to improve the protocol's security. To the best of our knowledge, this is the first work exploiting the popular MAVLink protocol for covert communications and demonstrating how it can be manipulated by the adversary for secret communications over commodity drones.

Significant performance improvements in bandwidth and latency make 5G a suitable candidate for a wide range of applications, particularly those requiring real-time communication, such as Industrial Control Systems (ICS) and autonomous vehicles. However, today’s security, including modern cryptographic systems, is prone to different attacks caused by the high computational power of quantum computing, highlighting the need for integrating quantum-resistant security measures. To accommodate attacks targeted at 5G networks, there are efforts to move towards TLS-based security, which is the widely accepted standard across networks. However, integrating post-quantum algorithms must also be considered in such a transition. Thus, this paper is the first to perform the integration of Post-quantum TLS (PQ-TLS) protocols into 5G networks and offer a realistic performance evaluation. Our approach focuses on integrating PQ-TLS into the 5G control plane (CP) without requiring a major overhaul, thus ensuring communications’ interoperability even with legacy components of 5G, which may not support TLS. Specifically, we have updated the registration and authentication protocols for both core network functions and user equipment (UE) by implementing a TLS tunneling approach through virtualization. We then evaluate the performance and feasibility of PQ-TLS in enhancing the security of 5G communications on an actual testbed. Our results demonstrate that while PQ algorithms introduce some overhead, they remain viable for 5G applications, particularly for protocols that can run on the core network.