头部缺失的JPEG文件碎片恢复

JPEG碎片恢复和修复一直是数字取证领域中的一个难点和热点问题,特别是在遇到JPEG文件的头部缺失或者损坏而导致其数据无法正常解码和显示时.提出一种头部缺失且无重启标记的JPEG文件碎片解码与显示问题的解决方法.首先提出了基于JPEG碎片数据的各种解码参数(哈夫曼表、图像宽度、量化表和采样因子等)的估算方法;其次对显示时出现的位置错位和颜色偏移问题提出了相应的调整算法.实验结果表明,本文方法能够正确有效地解码并显示没有头部与重启标记的JPEG文件碎片.     

基于差异度的JPEG碎片重组方法

针对JPEG文件特征,提出一种基于差异度的JPEG碎片重组方法JFDDM。利用图片相邻像素间的相似性,通过匹配MCU单元的差异度判断碎片是否属于同一文件。对标准图片集的实验结果表明,该方法对不同类型的JPEG图片表现出较好的适应性,碎片重组效果良好。     

基于两种数据类型的计算机取证技术研究

计算机取证是针对计算机犯罪中产生和留下的数据进行检测、获取和分析技术。本文介绍了计算机取证过程中需要收集的稳定型和非稳定型两类基本数据,结合反取证技术,对基于这两种数据类型的计算机取证技术进行了较为详细的分析和研究。     

MTK手机Flash芯片文件系统恢复研究

目前针对手机的取证软件大部分是从逻辑层面提取数据而不是从存储介质中提取数据,本文提出了从底层对闪存进行取证的方法,并给出三种从底层拷贝闪存数据的方法。基于MTK不同芯片型号的NandFlash使用的文件系统进行研究,针对不同MTK芯片型号的手机展示了如何拷贝FLASH存储介质中的数据,将提取的闪存镜像数据重组并转换为普通取证工具所能识别的文件系统,并在此基础上提取手机上的电话本、短信、图片等重要数据[1]。     

利用块效应特征的JPEG图像盲取证研究进展

数字图像的盲取证技术由于不依赖任何预嵌入的信息来鉴别图像真实性和完整性的优势,正逐步成为数字媒体安全领域新的研究热点。由于JPEG图像是目前最流行的图像格式,并且块效应是JPEG图像与生俱来的本质特征,因此如何更加有效地利用块效应特征对JPEG图像的真伪进行盲取证研究具有非常重要的现实意义和应用价值。首先对目前国内外利用JPEG图像编码特性的盲取证方法进行归类分析;然后重点针对利用块效应特征的JPEG图像盲取证技术展开讨论,详细介绍并总结了基于块效应测度和基于块效应网格提取的两类盲取证算法的核心思想和局限性;最后提出了存在的问题及未来的研究方向。     

一种基于Linux的动态取证策略

计算机动态取证是信息安全领域的研究热点,在简单介绍取证策略的基础上,提出一种基于Linux的计算机动态取证策略。该策略将Linux系统下的待取证数据分为两类,并采用不同的方法来取证：对于易失性的数据,通过分析内核的数据结构来获取证据;对于非易失性的数据,利用取证工具和系统命令来获取证据。在Linux9.0上进行了实验。实验表明,采用该策略能够对Linux系统下的常见入侵进行动态取证。     

快递

Oracle 8.0.4企业版适合于那些需要支持大容量在线事务处理或数据仓库功能的企业。该工具增添JDBC访问特征、新的扩展数据类型和性能数据收集工具。优点增加了JDBC(JAVA数据库连接)访问特征,支持JDK(JAVA开发工具)1.02和1.1版,拥有更多的扩展数据类型,如时间系列数据,包括性能数据收集工具。     

云计算取证模型

针对云取证面临的主要挑战,分析云计算特性,提出了一种云取证模型。提出了持续性取证准备服务的部署、基于“迭代”的多轮次证据识别策略和分布式文件系统的多层级数据定位方法、基于“数据隔离”和“按需收集”策略的证据收集方法、基于云计算资源的综合性证据分析平台的建立。最后,结合云环境下的取证场景,分析了该模型的有效性。     

基于重采样检测的JPEG图像拼接篡改取证

数字图像在进行拼接篡改时,为了不留下视觉上的明显篡改痕迹,往往会对篡改的区域进行缩放、旋转等重采样操作。针对这一现象,本文提出一种新的基于重采样检测的JPEG图像拼接篡改取证算法,该算法通过对JPEG图像局部区域二阶导数进行Radon变换,并求其自协方差后进行快速傅里叶变换,在频域中消除JPEG压缩的影响,最后判断该局部区域是否经过重采样操作,以作为判断被检测的JPEG图像是否经过拼接篡改的证据。实验结果表明,本文算法对于经过包括缩放和旋转等重采样操作后拼接成的JPEG图像有较好的篡改取证效果。     

基于PowerShell脚本的可疑程序取证工具设计

安全用户经常需要分析并找出系统中的可疑程序.利用Windows的PowerShell、WMI和内置程序实现了一个可疑程序取证工具,它能够辅助安全用户对可疑程序进行分析和取证.相较于第三方工具,该工具更加方便、安全、可靠,在某些方面也更加智能.测试结果表明,该工具能够切实地辅助安全用户识别可疑程序,收集与可疑程序有关的重...     

Slicing for architectural analysis

Current software development often relies on non-trivial coordination logic for combining autonomous services, eventually running on different platforms. As a rule, however, such a coordination layer is strongly woven within the application at source code level. Therefore, its precise identification becomes a major methodological (and technical) problem and a challenge to any program understanding or refactoring process.The approach introduced in this paper resorts to slicing techniques to extract coordination data from source code. Such data are captured in a specific dependency graph structure from which a coordination model can be recovered either in the form of an Orc specification or as a collection of code fragments corresponding to the identification of typical coordination patterns in the system. Tool support is also discussed.     

Demaq/Transscale: Automated distribution and scalability for declarative applications

The goal of the Demaq/TransScale system is to automate the distribution of applications to multiple hosts. Today, in order to create highly scalable architectures, developers have to manually restructure the application logic, creating balanced application fragments and data partitions to distribute across the available host machines. Our approach automates much of this manual work. We show how a novel, messaging-based programming model allows to implement distribution as a source-level transformation that turns a non-distributed application specification into a set of programs that can be executed on the various machines of a cluster. The challenge is the identification of application fragments that can be executed independently of each other, such that each fragment can be executed using only local transactions. Further, our method allows developers to increase scalability (i.e. the number of possible fragments) by choosing from a library of automatically applicable rewrites. As a running example, and for the reported experimental results, we use TPC-App as a benchmark application.     

单体型组装问题计算模型的比较与分析

单体型检测在遗传病基因的定位、药理反应的研究、个体识别等方面有极其广阔的应用前景。单体型组装问题指如何利用个体的基因测序片断数据,根据不同的优化准则确定该个体单体型的计算问题。对MSR,MFR,MEC,WMLF,MEC／GI等单体型组装模型做了详细的分析比较,得出了如下结论：在没有引入测序误差情况下,上述模型的重构精度基本一致。随着测序误差的增加,MEC／GI模型的容错性最好,重构精度最高;MSR模型受测序误差的影响最大,只适用于测序误差极小的情形。     

Superimposition-based protocol as a tool for determining bioactive conformations. II. Application to the GABA(A) receptor.

The natural templates (NT) superimposition method is used to determine the pharmacophoric requirements of the A subtype of the gamma-aminobutyric acid (GABA) receptor. Bioactive conformations for antagonists and agonists are found by superimposing them on a relatively rigid alkaloid bicuculline, which itself is a competitive antagonist at this ligand-gated ion channel receptor. As has been usual in the application of this modeling method, consideration of available experimental data is the cornerstone for obtaining realistic models. The identification of two substructural fragments of bicuculline permitted classification of the ligands. Analysis of the antagonists and agonists with respect to the two substructural fragments revealed two bioactive conformations of the highly flexible GABA molecule, one of which is extended with the nonhydrogenic atoms roughly coplanar torsional angles of -37 and -179 degrees at N-C-C-C and C-C-C-C (carboxyl), respectively. The second bioactive compound is clearly non planar (torsional angles of -81 and -109 degrees at N-C-C-C and C-C-C-C (carboxyl), respectively).     

Image fragment search and identification based on adaptive pseudogradient algorithms

The pseudogradient approach as applied to solving image search, identification, and determination problems for parameters of location of image fragments is considered. The image and the sought fragments can have mutual geometric and luminance deformations. Structural optimization of algorithms is used to cut down computational costs. Relations for the probability of erroneous fragment choice and the discrete distributions of probabilities of the number of the algorithm’s iterations are found.     

A method of identification of image fragments on the basis of multiresponse statistical models

This paper proposes a method for identifying image fragments presented by a multiresponse piecewise-linear model of segments and corner points, which considers the geometric and color contour. The method can improve the accuracy of identification of fragments and the subsequent reconstruction of a fragmented image.     

Secure and efficient data transfer using spreading and assimilation in MANET

Mobile ad hoc Network (MANET) is a cluster of moveable devices connected through a wireless medium to design network with rapidly changing topologies due to mobility. MANETs are applicable in variety of innovative application scenarios where smart devices exchange data among each other. In this case, security of data is the major concern to provide dependable solution to users. This article presents a secure mechanism for data transfer where sender splits the data into fragments and receiver gets the actual data by assimilating the data fragments. We have presented an Enhanced Secured Lempel-Ziv-Welch (ES-LZW) algorithm that provides cryptographic operations for secure data transfer. In proposed model, we have utilized the disjoint paths to transfer the data fragments from sender side and assimilate these fragments at receiver to get the original data. The messages containing data fragments are compressed and encrypted as well. Our scheme ensures confidentiality, integrity, efficient memory utilization, and resilience against node compromising attacks. We have validated our work through extensive simulations in NS-2.35 using TCL and C language. Results prove that our scheme reduces memory consumption along with less encryption and decryption cost as compared to blowfish especially when plaintext has more repetitive data. We have also analyzed the impact of creating data fragments, fraction of communication compromised, and probability to compromise the data fragments by subverting intermediaries.