Search

An online social network is a platform that is continuously expanding, which enables groups of people to share their views and communicate with one another using the Internet. The social relations among members of the public are significantly improved because of this gesture. Despite these advantages and opportunities, criminals are continuing to broaden their attempts to exploit people by making use of techniques and approaches designed to undermine and exploit their victims for criminal activities. The field of digital forensics, on the other hand, has made significant progress in reducing the impact of this risk. Even though most of these digital forensic investigation techniques are carried out manually, most of these methods are not usually appropriate for use with online social networks due to their complexity, growth in data volumes, and technical issues that are present in these environments. In both civil and criminal cases, including sexual harassment, intellectual property theft, cyberstalking, online terrorism, and cyberbullying, forensic investigations on social media platforms have become more crucial. This study explores the use of machine learning techniques for addressing criminal incidents on social media platforms, particularly during forensic investigations. In addition, it outlines some of the difficulties encountered by forensic investigators while investigating crimes on social networking sites. [ABSTRACT FROM AUTHOR]

Cybercrime is a significant threat to Internet users, involving crimes committed using computers or computer networks. The landscape of cyberspace presents a complex terrain, making the task of tracing the origins of sensitive data a formidable and often elusive endeavor. However, tracing the source of sensitive data in online cyberspace is critically challenging, and detecting cyber-criminals on the other hand remains a time-consuming process, especially in social networks. Cyber-criminals target individuals for financial gain or to cause harm to their assets, resulting in the loss or theft of millions of user data over the past few decades. Forensic professionals play a vital role in conducting successful investigations and acquiring legally acceptable evidence admissible in court proceedings using modern techniques. This study aims to provide an overview of forensic investigation methods for extracting digital evidence from computer systems and mobile devices to combat persistent cybercrime. It also discusses current cybercrime issues and mitigation procedures. [ABSTRACT FROM AUTHOR]

Transport Layer Security (TLS) based malware is one of the most hazardous malware types, as it relies on encryption to conceal connections. Due to the complexity of TLS traffic decryption, several anomaly-based detection studies have been conducted to detect TLS-based malware using different features and machine learning (ML) algorithms. However, most of these studies utilized flow features with no feature transformation or relied on inefficient flow feature transformations like frequency-based periodicity analysis and outlier percentage. This paper introduces TLSMalDetect, a TLS-based malware detection approach that integrates periodicity-independent entropy-based flow set (EFS) features generated by a flow feature transformation technique to solve flow feature utilization issues in related research. The effectiveness of EFS features was evaluated in two ways: (1) by comparing them to the corresponding outlier percentage and flow features using four feature importance methods, and (2) by analyzing classification performance with and without EFS features. Moreover, new Transmission Control Protocol features not explored in the literature were incorporated into TLSMalDetect, and their contribution was assessed. This study's results proved that EFS features of the number of packets sent and received were superior to the related outlier percentage and flow features and could remarkably increase the performance up to ~42 percent in the case of Support Vector Machine accuracy. Furthermore, using the basic features, TLSMalDetect achieved the highest accuracy of 93.69 percent by Naïve Bayes (NB) among the ML algorithms applied. From a comparison view, TLSMalDetect's Random Forest precision of 98.99 percent and NB recall of 92.91 percent exceeded the best relevant findings of previous studies. These comparative results demonstrated TLSMalDetect's ability to detect more malware flows out of total malicious flows than existing works. It could also generate more actual alerts from overall alerts than earlier research. [ABSTRACT FROM AUTHOR]

Advancements in electronic health record system allow patients to store and selectively share their medical records as needed with doctors. However, privacy concerns represent one of the major threats facing the electronic health record system. For instance, a cybercriminal may use a brute-force attack to authenticate into a patient's account to steal the patient's personal, medical or genetic details. This threat is amplified given that an individual's genetic content is connected to their family, thus leading to security risks for their family members as well. Several cases of patient's data theft have been reported where cybercriminals authenticated into the patient's account, stole the patient's medical data and assumed the identity of the patients. In some cases, the stolen data were used to access the patient's accounts on other platforms and in other cases, to make fraudulent health insurance claims. Several measures have been suggested to address the security issues in electronic health record systems. Nevertheless, we emphasize that current measures proffer security in the short-term. This work studies the feasibility of using a decoy-based system named HoneyDetails in the security of the electronic health record system. HoneyDetails will serve fictitious medical data to the adversary during his hacking attempt to steal the patient's data. However, the adversary will remain oblivious to the deceit due to the realistic structure of the data. Our findings indicate that the proposed system may serve as a potential measure for safeguarding against patient's information theft. [ABSTRACT FROM AUTHOR]

The most pressing issue in network security is the establishment of an approach that is capable of detecting violations in computer systems and networks. There have been several efforts for improving it from various points of view. One example is the improvement of the classification of packets on the network, which is imperative in detecting abnormal traffic and hence any potential intrusion. Thus, this study proposes a new approach for intrusion detection that is implemented using an enhanced Bat algorithm (EBat) for training an artificial neural network. The goal of the current study is to increase the accuracy of the classification for malicious and un-malicious network traffic. The proposed study herein includes a comparison with nine other metaheuristic algorithms (conventional and new algorithms) that are used to evaluate the new approach alongside the related works. Firstly, the EBat algorithm was developed and used to select suitable weights and biases. Next, the neural network was employed using the found optimal weights and biases to realize the intrusion detection approach. Four types of intrusion detection evaluation datasets were used to compare the proposed approach against the other algorithms. The findings revealed that the proposed method outperformed the other nine classification algorithms and it is unparalleled for the network intrusion detection. [ABSTRACT FROM AUTHOR]

In this paper, an enhanced honey encryption (HE) scheme for reinforcing the security of instant messaging systems and confounding the time and resources of malicious persons is presented. HE offers security beyond the brute-force bound by yielding plausible-looking but fake plaintext upon decryption with an incorrect key. Recent developments have seen the application of HE in the security of specific real-world systems, such as passwords and credit cards. However, applying the HE scheme to address other economic problems remains a daunting task as it requires modifying the HE algorithm to fit into the problem-in-view. For instance, applying the scheme for robust transmission of chat-messages upon decryption with an incorrect key will demand to generate contextually correct, valid-looking but fake chat-message which is indistinguishable from a human-generated message. This paper enhances the HE scheme by leveraging natural language processing techniques to build semantically plausible but fake chat-messages which will be served to the adversary during his attacks. Findings from evaluations reveal that the novel system is resilient to eavesdropping as an adversary is unable to distinguish decoy messages from the plaintext upon decryption with an incorrect key. [ABSTRACT FROM AUTHOR]

Arguably the most recurring issue concerning network security is building an approach that is capable of detecting intrusions into network systems. This issue has been addressed in numerous works using various approaches, of which the most popular one is to consider intrusions as anomalies with respect to the normal traffic in the network and classify network packets as either normal or abnormal. Improving the accuracy and efficiency of this classification is still an open problem to be solved. The study carried out in this article is based on a new approach for intrusion detection that is mainly implemented using the Hybrid Artificial Bee Colony algorithm (ABC) and Monarch Butterfly optimization (MBO). This approach is implemented for preparing an artificial neural system (ANN) in order to increase the precision degree of classification for malicious and non-malicious traffic in systems. The suggestion taken into consideration was to place side-by-side nine other metaheuristic algorithms that are used to evaluate the proposed approach alongside the related works. In the beginning the system is prepared in such a way that it selects the suitable biases and weights utilizing a hybrid (ABC) and (MBO). Subsequently the artificial neural network is retrained by using the information gained from the ideal weights and biases which are obtained from the hybrid algorithm (HAM) to get the intrusion detection approach able to identify new attacks. Three types of intrusion detection evaluation datasets namely KDD Cup 99, ISCX 2012, and UNSW-NB15 were used to compare and evaluate the proposed technique against the other algorithms. The experiment clearly demonstrated that the proposed technique provided significant enhancement compared to the other nine classification algorithms, and that it is more efficient with regards to network intrusion detection. [ABSTRACT FROM AUTHOR]

The tumultuous increase in ATM attacks using eavesdropping, shoulder-surfing, has risen great concerns. Attackers often target the authentication stage where a customer may be entering his login information on the ATM and thus use direct observation techniques by looking over the customer's shoulder to steal his passwords. Existing authentication mechanism employs the traditional password-based authentication system which fails to curb these attacks. This paper addresses this problem using the FingerEye. The FingerEye is a robust system integrated with iris-scan authentication. A customer’s profile is created at registration where the pattern in his iris is analyzed and converted into binary codes. The binary codes are then stored in the bank database and are required for verification prior to any transaction. We leverage on the iris because every user has unique eyes which do not change until death and even a blind person with iris can be authenticated too. We implemented and tested the proposed system using CIMB bank, Malaysia as case study. The FingerEye is integrated with the current infrastructure employed by the bank and as such, no extra cost was incurred. Our result demonstrates that ATM attacks become impractical. Moreover, transactions were executed faster from 6.5 seconds to 1.4 seconds. [ABSTRACT FROM AUTHOR]

Conventional encryption schemes are susceptible to brute-force attacks. This is because bytes encode utf8 (or ASCII) characters. Consequently, an adversary that intercepts a ciphertext and tries to decrypt the message by brute-forcing with an incorrect key can filter out some of the combinations of the decrypted message by observing that some of the sequences are a combination of characters which are distributed non-uniformly and form no plausible meaning. Honey encryption (HE) scheme was proposed to curtail this vulnerability of conventional encryption by producing ciphertexts yielding valid-looking, uniformly distributed but fake plaintexts upon decryption with incorrect keys. However, the scheme works for only passwords and PINS. Its adaptation to support encoding natural language messages (e-mails, human-generated documents) has remained an open problem. Existing proposals to extend the scheme to support encoding natural language messages reveals fragments of the plaintext in the ciphertext, hence, its susceptibility to chosen ciphertext attacks (CCA). In this paper, we modify the HE schemes to support the encoding of natural language messages using Natural Language Processing techniques. Our main contribution was creating a structure that allowed a message to be encoded entirely in binary. As a result of this strategy, most binary string produces syntactically correct messages which will be generated to deceive an attacker who attempts to decrypt a ciphertext using incorrect keys. We evaluate the security of our proposed scheme. [ABSTRACT FROM AUTHOR]

This article introduces a new variation of a known metaheuristic method for solving global optimization problems. The proposed algorithm is based on the Bat algorithm (BA), which is inspired by the micro-bat echolocation phenomenon, and addresses the problems of local-optima trapping using a special mutation operator that enhances the diversity of the standard BA, hence the name enhanced Bat algorithm (EBat). The design of EBat is introduced and its performance is evaluated against 24 of the standard benchmark functions, and compared to that of the standard BA, as well as to several well-established metaheuristic techniques. We also analyze the impact of different parameters on the EBat algorithm and determine the best combination of parameter values in the context of numerical optimization. The obtained results show that the new EBat method is indeed a promising addition to the arsenal of metaheuristic algorithms and can outperform several existing ones, including the original BA algorithm. [ABSTRACT FROM AUTHOR]

The objective of this article is twofold. On the one hand, we introduce a cognitively inspired hybridization metaheuristic that combines the strengths of two existing metaheuristics: the artificial bee colony (ABC) algorithm and the dragonfly algorithm (DA). The aim of this hybridization is to reduce the problems of slow convergence and trapping into local optima, by striking a good balance between global and local search components of the constituent algorithms. On the other hand, we use the proposed metaheuristic to train a multi-layer perceptron (MLP) as an alternative to existing traditional- and metaheuristic-based learning algorithms; this is for the purpose of improving overall accuracy by optimizing the set of MLP weights and biases. The proposed hybrid ABC/DA (HAD) algorithm comprises three main components: the static and dynamic swarming behavior phase in DA and two global search phases in ABC. The first one performs global search (DA phase), the second one performs local search (onlooker phase), and the third component implements global search (modified scout bee phase). The resultant metaheuristic optimizer is employed to train an MLP to reach a set of weights and biases that can yield high performance compared to traditional learning algorithms or even other metaheuristic optimizers. The proposed algorithm was first evaluated using 33 benchmark functions to test its performance in numerical optimization problems. Later, using HAD for training MLPs was evaluated against six standard classification datasets. In both cases, the performance of HAD was compared with the performance of several new and old metaheuristic methods from swarm intelligence and evolutionary computing. Experimental results show that HAD algorithm is clearly superior to the standard ABC and DA algorithms, as well as to other well-known algorithms, in terms of achieving the best optimal value, convergence speed, avoiding local minima and accuracy of trained MLPs. The proposed algorithm is a promising metaheuristic technique for general numerical optimization and for training MLPs. Specific applications and use cases are yet to be explored fully but they are supported by the encouraging results in this study. [ABSTRACT FROM AUTHOR]

The aim of the study was to propose a new metaheuristic algorithm that combines parts of the well-known artificial bee colony (ABC) optimization with elements from the recent monarch butterfly optimization (MBO) algorithm. The idea is to improve the balance between the characteristics of exploration and exploitation in those algorithms in order to address the issues of trapping in local optimal solution, slow convergence, and low accuracy in numerical optimization problems. This article introduces a new hybrid approach by modifying the butterfly adjusting operator in MBO algorithm and uses that as a mutation operator to replace employee phase of the ABC algorithm. The new algorithm is called Hybrid ABC/MBO (HAM). The HAM algorithm is basically employed to boost the exploration versus exploitation balance of the original algorithms, by increasing the diversity of the ABC search process using a modified operator from MBO algorithm. The resultant design contains three components: The first and third component implements global search, while the second one performs local search. The proposed algorithm was evaluated using 13 benchmark functions and compared with the performance of nine metaheuristic methods from swarm intelligence and evolutionary computing: ABC, MBO, ACO, PSO, GA, DE, ES, PBIL, and STUDGA. The experimental results show that the HAM algorithm is clearly superior to the standard ABC and MBO algorithms, as well as to other well-known algorithms, in terms of achieving the best optimal value and convergence speed. The proposed HAM algorithm is a promising metaheuristic technique to be added to the repertory of optimization techniques at the disposal of researchers. The next step is to look into application fields for HAM. [ABSTRACT FROM AUTHOR]

Digital forensics is a vital part of almost every criminal investigation given the amount of information available and the opportunities offered by electronic data to investigate and evidence a crime. However, in criminal justice proceedings, these electronic pieces of evidence are often considered with the utmost suspicion and uncertainty, although, on occasions are justifiable. Presently, the use of scientifically unproven forensic techniques are highly criticized in legal proceedings. Nevertheless, the exceedingly distinct and dynamic characteristics of electronic data, in addition to the current legislation and privacy laws remain as challenging aspects for systematically attesting evidence in a court of law. This article presents a comprehensive study to examine the issues that are considered essential to discuss and resolve, for the proper acceptance of evidence based on scientific grounds. Moreover, the article explains the state of forensics in emerging sub-fields of digital technology such as, cloud computing, social media, and the Internet of Things (IoT), and reviewing the challenges which may complicate the process of systematic validation of electronic evidence. The study further explores various solutions previously proposed, by researchers and academics, regarding their appropriateness based on their experimental evaluation. Additionally, this article suggests open research areas, highlighting many of the issues and problems associated with the empirical evaluation of these solutions for immediate attention by researchers and practitioners. Notably, academics must react to these challenges with appropriate emphasis on methodical verification. Therefore, for this purpose, the issues in the experiential validation of practices currently available are reviewed in this study. The review also discusses the struggle involved in demonstrating the reliability and validity of these approaches with contemporary evaluation methods. Furthermore, the development of best practices, reliable tools and the formulation of formal testing methods for digital forensic techniques are highlighted which could be extremely useful and of immense value to improve the trustworthiness of electronic evidence in legal proceedings. [ABSTRACT FROM AUTHOR]

This study proposes a novel approach based on multi-objective artificial bee colony (ABC) for feature selection, particularly for intrusion-detection systems. The approach is divided into two stages: generating the feature subsets of the Pareto front of non-dominated solutions in the first stage and using the hybrid ABC and particle swarm optimization (PSO) with a feed-forward neural network (FFNN) as a classifier to evaluate feature subsets in the second stage. Thus, the proposed approach consists of two stages: (1) using a new feature selection technique called multi-objective ABC feature selection to reduce the number of features of network traffic data and (2) using a new classification technique called hybrid ABC-PSO optimized FFNN to classify the output data from the previous stage, determine an intruder packet, and detect known and unknown intruders. [ABSTRACT FROM AUTHOR]

A capable, scalable, and reliable model detects intrusive traffic by investigating the impact of user behavior on quality-of-service regulations in real time. The model also proposes reliable coordination for investigating user traffic, including traffic injected through several gateways. Traffic investigation is triggered only when the network is congested; at that moment, burst gateways generate an echo of explicit congestion notification to misbehaving users. The model investigates these users by measuring their bandwidth consumption ratios. User traffic that exceeds the service-level agreement bandwidth ratio is filtered as intrusive. Simulation results demonstrate that the proposed model efficiently monitors user behavior and detects intrusive traffic. [ABSTRACT FROM PUBLISHER]

Bandwidth abuse is a critical Internet service violation. However, its origins are difficult to detect and trace given similarities between abusive and normal traffic. So far, there is no capable and scalable mechanism to deal with bandwidth abuse. This paper proposes a distributed edge-to-edge model for monitoring service level agreement (SLA) violations and tracing abusive traffic to its origins. The mechanism of policing misbehaving user traffic at a single random early detection (RED) gateway is used in the distributed monitoring of SLA violations, including violations carried out through several gateways. Each RED gateway reports misbehaving users who have been sent notifications of traffic policing to an SLA monitoring unit. Misbehaving users are considered suspicious users and their consumed bandwidth shares are aggregated at every gateway to be compared with SLA-specified ratios. Bandwidth is abused when SLA-specified ratios are exceeded. By reporting bandwidth abuse, illegitimate users can be isolated from legitimate ones and source hosts of abusive traffic may be traced. Approximate simulation results show that the proposed model can detect any SLA violation and identify abusive users. In addition, the proposed model can trace user violations back to their source machines in real time. [ABSTRACT FROM AUTHOR]

Although Hopfield neural network is one of the most commonly used neural network models for auto-association and optimization tasks, it has several limitations. For example, it is well known that Hopfield neural networks has limited stored patterns, local minimum problems, limited noise ratio, retrieve reverse value of pattern, and shifting and scaling problems. This research will propose multi-connect architecture (MCA) associative memory to improve the Hopfield neural network by modifying the net architecture, learning and convergence processes. This modification is to increase the performance of associative memory neural network by avoiding most of the Hopfield neural network limitations. In general, MCA is a single layer neural network uses auto-association tasks and working in two phases, that is learning and convergence phases. MCA was developed based on two principles. First, the smallest net size will be used rather than depending on the pattern size. Second, the learning process will be performed to the limited parts of the pattern only to avoid learning similar parts several times. The experiments performed show promising results when MCA shows high efficiency associative memory by avoiding most of the Hopfield net limitations. The results proved that the MCA net can learn and recognize unlimited patterns in varying size with acceptable percentage noise rate in comparison to the traditional Hopfield neural network. [ABSTRACT FROM AUTHOR]