The ease of reproducibility of digital artifacts raises a growing concern in copyright infringement; in particular, for a software product. Software watermarking is one of the promising techniques to verify the owner of licensed software by embedding a digital fingerprint. Developing an ideal software watermark scheme is challenging because i) unlike digital media watermarking, software watermarking must preserve the original code semantics after inserting software watermark, and ii) it requires well-balanced properties of credibility, resiliency, capacity, imperceptibility, and efficiency. We present SoftMark, a software watermarking system that leverages a function relocation where the order of functions implicitly encodes a hidden identifier. By design, SoftMark does not introduce additional structures (i.e., codes, blocks, or subroutines), being robust in unauthorized detection, while maintaining a negligible performance overhead and reasonable capacity. With various strategies against viable attacks (i.e., static binary re-instrumentation), we tackle the limitations of previous reordering-based approaches. Our empirical results demonstrate the practicality and effectiveness by successful embedding and extraction of various watermark values.

Recent cyber-attacks have used unknown malicious code or advanced attack techniques, such as zero-day attacks, making them extremely difficult to detect using traditional intrusion detection systems. Botnet attacks, for example, are a very sophisticated type of cyber-security threat. Malicious code or vulnerabilities are used to infect endpoints. Systems infected with this malicious code connect a communications channel to a command and control (C&C) server and receive commands to perform attacks on target servers. To effectively protect a corporate network’s resources against such threats, we must be able to detect infected systems before an attack occurs. In this paper, an attack pattern chain algorithm (APChain) is proposed to identify infected systems in real-time network environments, and a methodology for detecting abnormal behavior through network-based behavioral profiling is explained. APChain analyzes the attribute information of real-time network traffic, connects chains over time, and conducts behavioral profiling of different attack types to detect abnormal behavior. The dataset used in the experiment employed real-time traffic accumulated over a period of six months, and the proposed algorithm was developed into a prototype for the experiment. The C&C channel detection accuracy was measured at 0.996, the true positive rate at 1.0, and the false positive rate at 0.003. This study proposes a methodology that can overcome the limitations of conventional security mechanisms and suggests an approach to the detection of abnormal behavior in a real-time network environment.

Abstract The number of applications loaded with malware is rapidly increasing in Android operating system (OS). These malwares spread through the official Android market “Play Store”, unofficial “black market”, and private web pages. Once the malware activates, personal information can be extracted and some data can be deleted, causing tremendous damage to users. In order to provide reliability on Android OS, there is a need to analyze and address these malwares and recover the modified data. In this paper, we propose an enhanced security framework for a reliable Android OS. The framework provides means to prevent influx of malware by examining the Android OS and file system. In addition, it recovers data once deleted by security breaches. Copyright © 2013 John Wiley & Sons, Ltd.

Sharing copyright protected content without the copyright holder’s permission is illegal in many countries. Regardless, the number of illegal file sharing using BitTorrent continues to grow and most of file sharers and downloader are unconcerned legal action to transfer copywrite-protected files. However, it is difficult to gather enough probative evidence to prosecute illegal file sharers in criminal court and/or sued for damages in civil court. Further, there is a lack of research on investigation techniques to reveal illegal BitTorrent sharers. This is because the role of the server in BitTorrent networks has been changed compared to servers in conventional P2P networks. As a result, it is difficult to apply previous investigation processes for investigation of conventional P2P networks to the investigation of suspected illegal file sharing using BitTorrent. This paper proposes a methodology for the investigation of illegal file sharers using BitTorrent networks through the use of a P2P digital investigation process.

ABSTRACT The ever growing storage device capacity poses a severe limit to the standard digital forensics collection procedures based on duplicating the original storage device by creating a bit‐by‐bit copy. Such a traditional procedure is followed, even if the goal of the investigation is to find a limited quantity of digital objects to support or refute an investigative hypothesis related to a precise case category. Therefore, in this paper, we propose a new methodology to deal with data leak cases, by applying an intelligent collection paradigm, a fast analysis approach that reduces investigation time. Copyright © 2012 John Wiley & Sons, Ltd.

ABSTRACT When a forensic investigation is carried out in the enterprise environment, most of the important data are stored in database servers, and data stored in them are very important elements for a forensic investigation. As for database servers with such data stored, there are over 10 various kinds, such as SQL Server and Oracle. All the methods of investigating a database system are important, but this study suggests a single methodology likely to investigate all the database systems while considering the unique characteristics of each database system. A method of detecting a server and acquiring and investigating data in the server can be effectively used for such an investigation on the enterprise environment. For the existing investigation on server systems, severs should be shut down, and disc imaging should be conducted first. However, such a method may inflict great losses on the company in some cases. That is why we need a method to acquire data of a server in on‐line state, and this study discusses this method. Besides, on the basis of methodology, this study attempts to determine a possibility that this new forensic investigation method can be practically used by directly applying this method to SQL Server and MySQL databases. Copyright © 2012 John Wiley & Sons, Ltd.

Numbers of companies are using AMS (Accounting Management System) to manage their accounting data. In the case of large corporations they tend to use ERP (Enterprise Resources Planning), but except them most of companies use AMS to manage their accounting information. In the other words, every company is using some sort of digital data format to manage their accounting data. Therefore, if there is a tool to extract and analyze accounting data to detect any financial fraud, a forensic accountant can use it wisely. This paper introduces about forensic accounting and its related works, and shows a design of forensic accounting tool that could extract accounting data from a company's AMS and analyze them.

Electronic documents made by some application (e.g. Microsoft PowerPoint application) have traces of work like editing, and these traces exist in the format of electronic documents. In digital forensic investigation, examiners have failed to notice traces of past work. It is because of that the traces of the past work cannot be identified by its application easily. However, identifying traces of the past work is important for digital forensic investigation because this data can be essential information which is created by culprit's intention not appeared in electronic document. This paper focuses on analyzing the Microsoft PowerPoint application (version 97 ~ 2003) which has the feature that it has traces of past work. In case of Microsoft PowerPoint file, it is possible to identify traces of past work by analyzing saving algorithm of application. To detect the traces automatically, PRIX (PPT residual information extractor) tool is developed.

Among previous proposed side channel analysis (SCA) methods, differential power analysis (DPA) based on the statistical characteristics of collected signals has been known as an efficient attack for uncovering the secret key of cryptosystems. However, the attack performance of this method is affected very much by the temporal misalignment and noise of collected side channel signals. In this letter, we propose a new method to surmount the noise problem in DPA. The performance of the proposed method is then evaluated while analyzing the power consumption signals of microcontroller chip during a DES operation. When we compare the experimental results with respect to the needed number of traces to uncover the secret key, our proposed method shows a performance enhancement of 33% in the time domain and 50% in the frequency domain without a time burden.

In this paper, we propose UsMSS (User-centric secure Multimedia Service System) which provides interoperability of multimedia contents among incompatible devices in intelligent home. In addition, an authentication method suitable for the intelligent home is suggested. Furthermore, the proposed system provides intelligent services by reflecting context information (user preference, user location, device status information, etc.) through a sensor network module and home server, providing transparent and secure service.

A statistical watermarking method is proposed in this paper. The proposed method uses two dzferent algorithm according to the statistical characteristic of wavelet subbands of m input image. We embed a logo watermark at the middle-frequency band for the robustness of it. The proposed method is a blind scheme, so we need only the watermarked image when the embedded watermark is extracted. We achieved PSNR values around 40dB as shown in the experiment results. It has vely fast processing speed and also robust against attacks.