A Web-Based Mouse Dynamics Visualization Tool for User Attribution in Digital Forensic Readiness

Ernsberger, Dominik; Ikuesan, Richard Adeyemi; Venter, Hein S.; Zugenmaier, Alf

doi:10.1007/978-3-319-73697-6_5

Cited by 14 publications

(7 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A Decision Tree is one of the most commonly used classification algorithms in the security domain (Berrueta, Morato, Magana, et al, 2019;Molina et al, 2021). Trees provide a rule-based approach to classification, and since security relies on rules, this is often the preferred approach (Adeyemi, Razak, Salleh, et al, 2016;Ernsberger, Ikuesan, Venter, et al, 2017;Mohlala, Ikuesan & Venter, 2018). The parameters used for the DT comprised the quality measure that integrates the Gini Index, with no pruning, and a minimum number of five records per node.…”

Section: Decision Tree (Dt)mentioning

confidence: 99%

Ransomware Detection using Process Memory

Singh

Ikuesan

Venter

2022

iccws

View full text Add to dashboard Cite

Ransomware attacks have increased significantly in recent years, causing great destruction and damage to critical systems and business operations. Attackers are unfailingly finding innovative ways to bypass detection mechanisms, which encouraged the adoption of artificial intelligence. However, most research summarizes the general features of AI and induces many false positives, as the behavior of ransomware constantly differs to bypass detection. Focusing on the key indicating features of ransomware becomes vital as this guides the investigator to the inner workings and main function of ransomware itself. By utilizing access privileges in process memory, the main function of the ransomware can be detected more easily and accurately. Furthermore, new signatures and fingerprints of ransomware families can be identified to classify novel ransomware attacks correctly. The current research used the process memory access privileges of the different memory regions of the behavior of an executable to quickly determine its intent before serious harm can occur. To achieve this aim, several well-known machine learning algorithms were explored with an accuracy range of 81.38% – 96.28%. The study thus confirms the feasibility of utilizing process memory as a detection mechanism for ransomware.

show abstract

Section: Decision Tree (Dt)mentioning

confidence: 99%

Ransomware Detection using Process Memory

Singh

Ikuesan

Venter

2022

iccws

View full text Add to dashboard Cite

show abstract

“…Here, the own users are recognized by their gestures It has gained high flaw rate and less exactness measure. Moreover, the security aspects also questionable in this scheme Ernsberger et al (2017) Mouse dynamics visualization system This process is executed in short duration, verification process relatively very fast Lacks in security against reply attack. Moreover, the system is operated in complex platform.…”

Section: Mouse Dynamicsmentioning

confidence: 99%

“…This method needs to be modified to make it suitable for non-intrusive continuous authentication. Ernsberger et al (2017) proposed mouse dynamics based on user identification from the angle of digital forensics. It has studied those user behavioural variances from interactions on different news websites.…”

Section: Mouse Dynamicsmentioning

confidence: 99%

A broad review on non-intrusive active user authentication in biometrics

Thomas¹,

Mathew

2021

J Ambient Intell Human Comput

View full text Add to dashboard Cite

Authentication is the process of keeping the user's personal information as confidential in digital applications. Moreover, the user authentication process in the digital platform is employed to verify the own users by some authentication methods like biometrics, voice recognition, and so on. Traditionally, a one-time login based credential verification method was utilized for user authentication. Recently, several new approaches were proposed to enhance the user authentication framework but those approaches have been found inconsistent during the authentication execution process. Hence, the main motive of this review article is to analyze the advantage and disadvantages of authentication systems such as voice recognition, keystroke, and mouse dynamics. These authentication models are evaluated in a continuous non-user authentication environment and their results have been presented in way of tabular and graphical representation. Also, the common merits and demerits of the discussed authentication systems are broadly explained discussion section. Henceforth, this study will help the researchers to adopt the best suitable method at each stage to build an authentication framework for non-intrusive active authentication.

show abstract

“…Attribution as a forensic component is major research challenge which has led to the adoption of some scientific evidence (or the lack of it) in litigation. However, till date, the scientific committee continue to grabble with the development of a reliable process model for user and device attribution in digital forensics [144]- [147]. That notwithstanding, with the changing nature of how data keeps changing with changing technologies, a more resilient cognitive model is projected to be a future challenge given that the forensic investigation of mobile architecture still remains complicated [148].…”

Section: Open Problems and Future Challengesmentioning

confidence: 99%

A Review of Mobile Forensic Investigation Process Models

et al. 2020

View full text Add to dashboard Cite

Mobile Forensics (MF) field uses prescribed scientific approaches with a focus on recovering Potential Digital Evidence (PDE) from mobile devices leveraging forensic techniques. Consequently, increased proliferation, mobile-based services, and the need for new requirements have led to the development of the MF field, which has in the recent past become an area of importance. In this article, the authors take a step to conduct a review on Mobile Forensics Investigation Process Models (MFIPMs) as a step towards uncovering the MF transitions as well as identifying open and future challenges. Based on the study conducted in this article, a review of the literature revealed that there are a few MFIPMs that are designed for solving certain mobile scenarios, with a variety of concepts, investigation processes, activities, and tasks. A total of 100 MFIPMs were reviewed, to present an inclusive and up-to-date background of MFIPMs. Also, this study proposes a Harmonized Mobile Forensic Investigation Process Model (HMFIPM) for the MF field to unify and structure whole redundant investigation processes of the MF field. The paper also goes the extra mile to discuss the state of the art of mobile forensic tools, open and future challenges from a generic standpoint. The results of this study find direct relevance to forensic practitioners and researchers who could leverage the comprehensiveness of the developed processes for investigation.INDEX TERMS Mobile forensics, investigation process model, digital forensics.

show abstract

A Web-Based Mouse Dynamics Visualization Tool for User Attribution in Digital Forensic Readiness

Cited by 14 publications

References 25 publications

Ransomware Detection using Process Memory

Ransomware Detection using Process Memory

A broad review on non-intrusive active user authentication in biometrics

A Review of Mobile Forensic Investigation Process Models

Contact Info

Product

Resources

About