tahar Kechadi

University College Dublin, Computer Science and Informatics, Faculty Member

Followers

Following

Co-authors

Public Views

Address: Dublin, Dublin, Ireland

less

Interests

Uploads

Papers by tahar Kechadi

Toward a new tool to extract the Evidence from a Memory Card of Mobile phones

arXiv (Cornell University), Sep 9, 2016

Download

Increasing digital investigator availability through efficient workflow management and automation

arXiv (Cornell University), Aug 29, 2017

The growth of digital storage capacities and diversity devices has had a significant time impact ... more The growth of digital storage capacities and diversity devices has had a significant time impact on digital forensic laboratories in law enforcement. Backlogs have become commonplace and increasingly more time is spent in the acquisition and preparation steps of an investigation as opposed to detailed evidence analysis and reporting. There is generally little room for increasing digital investigation capacity in law enforcement digital forensic units and the allocated budgets for these units are often decreasing. In the context of developing an efficient investigation process, one of the key challenges amounts to how to achieve more with less. This paper proposes a workflow management automation framework for handling common digital forensic tools. The objective is to streamline the digital investigation workflow -enabling more efficient use of limited hardware and software. The proposed automation framework reduces the time digital forensic experts waste conducting time-consuming, though necessary, tasks. The evidence processing time is decreased through server-side automation resulting in 24/7 evidence preparation. The proposed framework increases efficiency of use of forensic software and hardware, reduces the infrastructure costs and license fees, and simplifies the preparation steps for the digital investigator. The proposed approach is evaluated in a real-world scenario to evaluate its robustness and highlight its benefits.

Download

Forensics in Industrial Control System: A Case Study

Lecture Notes in Computer Science, 2016

Industrial Control Systems (ICS) are used worldwide in critical infrastructures. An ICS system ca... more Industrial Control Systems (ICS) are used worldwide in critical infrastructures. An ICS system can be a single embedded system working standalone for controlling a simple process or ICS can also be a very complex Distributed Control System (DCS) connected to Supervisory Control And Data Acquisition (SCADA) system(s) in a nuclear power plant. Although ICS are widely used today, there are very little research on the forensic acquisition and analyze ICS's artefacts. In this paper we present a case study of forensics in ICS where we describe a method of safeguarding important volatile artefacts from an embedded industrial control system and several other sources.

Download

Investigation and Automating Extraction of Thumbnails Produced by Image Viewers

Data carving is generally used to recover deleted images in digital investigations, but carving t... more Data carving is generally used to recover deleted images in digital investigations, but carving time can be significant and the deleted images may have been overwritten. Thus, thumbnails of (deleted) images are an alternative evidence, and can often be found within databases created by either operating systems or image viewers. Existing literature generally focus on the extraction of thumbnails from databases created by the operating system. Understanding thumbnails created by image reviewers is relatively understudied. Therefore, in this paper, we propose a new approach of automating extraction of thumbnails produced by image viewers. We then evaluate the utility of our approach using popular image viewers.

Download

Blockchain Application on the Internet of Vehicles (IoV)

With the rapid development of the Internet of Things (IoT) and its potential integration with the... more With the rapid development of the Internet of Things (IoT) and its potential integration with the traditional Vehicular Ad-Hoc Networks (VANETs), we have witnessed the emergence of the Internet of Vehicles (IoV), which promises to seamlessly integrate into smart transportation systems. However, the key characteristics of IoV, such as high-speed mobility and frequent disconnections make it difficult to manage its security and privacy. The Blockchain, as a distributed tamper-resistant ledge, has been proposed as an innovative solution that guarantees privacy-preserving yet secure schemes. In this paper, we review recent literature on the application of blockchain to IoV, in particular, and intelligent transportation systems in general.

Download

Blockchain Application on the Internet of Vehicles (IoV)

2022 IEEE 7th International Conference on Intelligent Transportation Engineering (ICITE)

Download

Forensics Acquisition of IMVU: A Case Study

arXiv (Cornell University), Sep 9, 2016

There are many applications available for personal computers and mobile devices that facilitate u... more There are many applications available for personal computers and mobile devices that facilitate users in meeting potential partners. There is, however, a risk associated with the level of anonymity on using instant message applications, because there exists the potential for predators to attract and lure vulnerable users. Today Instant Messaging within a Virtual Universe (IMVU) combines custom avatars, chat or instant message (IM), community, content creation, commerce, and anonymity. IMVU is also being exploited by criminals to commit a wide variety of offenses. However, there are very few researches on digital forensic acquisition of IMVU applications. In this paper, we discuss first of all on challenges of IMVU forensics. We present a forensic acquisition of an IMVU 3D application as a case study. We also describe and analyse our experiments with this application.

Download

Edge-enabled Metaverse: The Convergence of Metaverse and Mobile Edge Computing

The Metaverse is a virtual environment where users are represented by avatars to navigate a virtu... more The Metaverse is a virtual environment where users are represented by avatars to navigate a virtual world, which has strong links with the physical one. State-of-the-art Metaverse architectures rely on a cloud-based approach for avatar physics emulation and graphics rendering computation. Such centralized design is unfavorable as it suffers from several drawbacks caused by the long latency required for cloud access, such as low quality visualization. To solve this issue, in this paper, we propose a Fog-Edge hybrid computing architecture for Metaverse applications that leverage an edge-enabled distributed computing paradigm, which makes use of edge devices computing power to fulfil the required computational cost for heavy tasks such as collision detection in virtual universe and computation of 3D physics in virtual simulation. The computational cost related to an entity in the Metaverse such as collision detection or physics emulation are performed at the end-device of the associate...

Download

Electronic Evidence Discovery, Identification and Preservation: Role of the First Responder and related capacity building challenges

The ADFSL 2019 Conference on Digital Forensics, Security and Law (ADFSL 2019), Daytona Beach, Florida, United States of America, 15-17 May 2019, May 17, 2019

The integrity of electronic evidence is essential for judicial proceedings. In this context, the ... more The integrity of electronic evidence is essential for judicial proceedings. In this context, the role of the First Responder for discovery, identification and preservation is considered to be one of the short-term most critical challenge. While the number of devices to be collected was reasonably small and the items were easily identifiable in the past, it is not the case anymore. Many initiatives aim at harmonising technical and legal standards to facilitate electronic evidence exchange, although a consistent approach in basic equipment and training of the field police officer is still missing. Hence, in this paper, we study how synergies between different international organisations create and deploy an innovative and sustainable approach to address capacity building challenges related to the tasks assigned to the First Responder.

Download

Volkswagen Car Entertainment System Forensics

2017 IEEE Trustcom/BigDataSE/ICESS, 2017

Vehicles are fast becoming another important source of digital evidence in a criminal investigati... more Vehicles are fast becoming another important source of digital evidence in a criminal investigation. Traditionally, when a vehicle is involved in a crime scene (e.g. drink driving), the investigators focus on the acquisition of DNA, fingerprints and other identifying materials, usually non digital in nature. However, modern day cars, particularly smart or driverless cars, store a wealth of digital information, such as recent destinations, favourite locations, routes, personal data such as call logs, contact lists, SMS messages, pictures, and videos. In this paper, we describe some challenges associated with vehicle data forensics, an understudied area. Next, we present our case study on forensic acquisition and data analysis of an entertainment system on a Volkswagen car.

Download

An Analytical Approach to the Recovery of Data from 3rd Party Proprietary CCTV File Systems

15th European Conference on Cyber Warfare and Security (ECCWS-16), Munich, Germany, 7-8 July 2016

Download

Title Formalization of SLAs for Cloud Forensic Readiness

Cloud Computing is one of the most pervasive ICT changes of the last few years. Usually, Clouds o... more Cloud Computing is one of the most pervasive ICT changes of the last few years. Usually, Clouds offer a variety of Services, which are accessible over the Internet. These Services are regulated by some contracts called Service Level Agreements between Service providers and customers. The SLAs have already been introduced in Service Oriented Architectures in situations where some computing services need to be structured and regulated. In an SLA, the constraints of use, the duties and responsibilities of the parties involved, the charges and the service levels to guarantee, etc., are clearly stated by dedicated clauses. Despite the efforts made in systems security and the standardisation of SLAs, Cloud Services continues to suffer from various cybercriminal attacks, and unfortunately this phenomenon is likely to escalate within the next few years. It becomes urgent to take some countermeasures against these illegal practices to increase both the customer trust and quality of services of such new technologies. One of the alternatives for this phenomenon is to provide an efficient cloud Forensic Readiness System (FRS) to prevent and alert the provider and/or customer of any suspect attacks or strange behaviour. Much attention has been given to FRSs and they have certainly moved from simple log files and monitoring to very sophisticated components involving both human experts and computer analysis tools. In this paper we study the effect of SLAs on FRSs. As SLAs may be different from one jurisdiction to another we believe that FRSs should also comply with jurisdiction for more efficiency and speed of isolating and resolving forensic cases. Therefore, we propose an FRS that takes into account automatically SLAs and issue warnings and alerts to its users (providers and consumers) based on the jurisdiction and the nature of security breach and attacks. These SLAs are presented to the system as a set of rules (clauses). This will also prevent illegal data transfers and communications among different jurisdictions. Part of this paper will be dedicated to the formalisation of these SLAs and study its consequences on the FRS architecture and functioning. The rest of the paper will be dedicated to the design and development of the FRS reference architecture integrating the proposed SLA formal model.

Download

A Cloud Forensic Readiness Model for Service Level Agreements Management

14th European Conference on Cyber Warfare and Security (ECCWS-2015), University of Herefordshire,... more

Download

Framework TDR for the LHCb Upgrade : Technical Design Report

This document is a Framework Technical Design Report for the upgrade of the LHCb experiment. It a... more This document is a Framework Technical Design Report for the upgrade of the LHCb experiment. It adds to the information in the Letter of Intent, in particular concerning the foreseen schedule, cost and participating institutes. Updates are given for the physics performance, based on the experience gained with the first full year of data taking, on the detector requirements and the progress of the sub-system R&D. Within the framework presented here, it is expected that the individual subsystem TDRs will follow on completion of the R&D phase in the next year.

Download

Domain Specific Entity Recognition With Semantic-Based Deep Learning Approach

IEEE Access, 2021

In digital agriculture, agronomists are required to make timely, profitable and more actionable p... more In digital agriculture, agronomists are required to make timely, profitable and more actionable precise decisions based on knowledge and experience. The input can be cultivated and related agricultural data, and one of them is text data, including news articles, business news, policy documents, or farming notes. To process this kind of data, identifying agricultural entities in the text is necessary to update news with agricultural orientation. This task is called Agriculture Entity Recognition (AGER -a kind of Named Entity Recognition task, NER, in the agriculture domain). However, there are very few approaches on AGER because of a lack of the consistent tagset and resources. In this study, we developed a new tagset for AGER to cover popular concepts in agriculture and we also propose a process for this task that consists of two stages: in the first stage, we use semantic-based approaches for detecting agricultural entities and semi-automatically build an annotated corpus of agricultural entities, while in the second stage, we identify the agricultural entities from the plain text using a deep learning approach, train on the annotated corpus. For the evaluation and validation, we build an annotated agriculture corpus and demonstrated the efficiency and robustness of our approach.

Download

Internet of Things Forensics – Challenges and a Case Study

Advances in Digital Forensics XIV, 2018

Today is the era of Internet of Things (IoT), millions of machines such as cars, smoke detectors,... more Today is the era of Internet of Things (IoT), millions of machines such as cars, smoke detectors, watches, glasses, webcams, etc. are being connected to the Internet. The number of machines that possess the ability of remote access to monitor and collect data is continuously increasing. This development makes, on one hand, the human life more comfortable, convenient, but it also raises on other hand issues on security and privacy. However, this development also raises challenges for the digital investigator when IoT devices involve in criminal scenes. Indeed, current research in the literature focuses on security and privacy for IoT environments rather than methods or techniques of forensic acquisition and analysis for IoT devices. Therefore, in this paper, we discuss firstly different aspects related to IoT forensics and then focus on the current challenges. We also describe forensic approaches for a IoT device -smartwatch as a case study. We analyze forensic artifacts retrieved from smartwatch devices and discuss on evidence found aligned with challenges in IoT forensics.

Download

Investigation and Automating Extraction of Thumbnails Produced by Image Viewers

2017 IEEE Trustcom/BigDataSE/ICESS, Aug 1, 2017

Today, in digital forensics, images normally provide important information within an investigatio... more Today, in digital forensics, images normally provide important information within an investigation. However, not all images may still be available within a forensic digital investigation as they were all deleted for example. Data carving can be used in this case to retrieve deleted images but the carving time is normally significant and these images can be moreover overwritten by other data. One of the solutions is to look at thumbnails of images that are no longer available. These thumbnails can often be found within databases created by either operating systems or image viewers. In literature, most research and practical focus on the extraction of thumbnails from databases created by the operating system. There is a little research working on the thumbnails created by the image reviewers as these thumbnails are application-driven in terms of pre-defined sizes, adjustments and storage location. Eventually, thumbnail databases from image viewers are significant forensic artefacts for investigators as these programs deal with large amounts of images. However, investigating these databases so far is still manual or semi-automatic task that leads to the huge amount of forensic time. Therefore, in this paper we propose a new approach of automating extraction of thumbnails produced by image viewers. We also test our approach with popular image viewers in different storage structures and locations to show its robustness.

Download

The Application of Data Mining to Predict the Occurrence of Short-Term Adverse Events in NB-UVB Phototherapy Treatments

International Journal of Machine Learning and Computing, 2018

The prediction of the occurrence of short-term adverse events in phototherapy treatments is impor... more The prediction of the occurrence of short-term adverse events in phototherapy treatments is important for dermatologists who administrate phototherapy to adjust the treatment and standardize the clinical outcomes. Recently, a modeling technique that can detect the potential occurrence of short-term adverse events in phototherapy treatments is required for clinicians. Based on data mining, this study tends to explore the significant features and the class distribution of training data for predicting the occurrence of short-term adverse events in NB-UVB phototherapy treatments. The experimental results highlight that an acceptable prediction accuracy can be achieved using the significant features and the performance of the classifiers can be significantly improved by sampling 40% of the negative class samples in the training data, hyper-parameter tuning of the classifiers and use of stacked classifiers in creating the prediction models.

Download

Parallel extraction of Regions‐of‐Interest from social media data

Concurrency and Computation: Practice and Experience, 2020

Geotagged data gathered from social media can be used to discover Places-of-Interest (PoIs) that ... more Geotagged data gathered from social media can be used to discover Places-of-Interest (PoIs) that have attracted many visitors. Since a PoI is generally identified by geographical coordinates of a single point, it is hard to match it with people trajectories. Therefore, we define an area, called -of-Interest (RoI), represented by the boundaries of a PoI. The main goal of this study is to discover Regions-of-Interest from PoIs using spatial data mining techniques. In this paper we propose a new parallel method for extracting RoIs from social media datasets. It consists of two main steps: i) automatic keywords extraction and data grouping, and ii) parallel RoIs extraction. The first step extracts keywords identifying the Places-of-Interests; these keywords are used to group social media items according to the places they refer to. The second step uses a Parallel Clustering Approach (ParCA) of spatial dataset to identify RoIs. ParCA exploits a parallel execution of DBSCAN on sub-sets of data to generate sub-clusters on each processing node, and then merge overlapping sub-clusters to form global clusters. ParCA was implemented using the MapReduce model. Experiments performed over a set of PoIs in the city of Rome using social media data show that our approach is highly scalable and reaches an accuracy of 79% in detecting RoIs. On a parallel computer with 50 cores, we obtained a speedup of 52 by processing large datasets divided into 32 splits, compared to the execution time registered when each dataset is not partitioned.

Download

Parallel and distributed clustering framework for big spatial data mining

International Journal of Parallel, Emergent and Distributed Systems, 2018

Clustering techniques are very attractive for identifying and extracting patterns of interests fr... more Clustering techniques are very attractive for identifying and extracting patterns of interests from datasets. However, their application to very large spatial datasets presents numerous challenges such as high-dimensionality, heterogeneity, and high complexity of some algorithms. Distributed clustering techniques constitute a very good alternative to the Big Data challenges (e.g., Volume, Variety, Veracity, and Velocity). In this paper, we developed and implemented a Dynamic Parallel and Distributed clustering (DPDC) approach that can analyse Big Data within a reasonable response time and produce accurate results, by using existing and current computing and storage infrastructure, such as cloud computing. The DPDC approach consists of two phases. The first phase is fully parallel and it generates local clusters and the second phase aggregates the local results to obtain global clusters. The aggregation phase is designed in such a way that the final clusters are compact and accurate while the overall process is efficient in time and memory allocation. DPDC was thoroughly tested and compared to wellknown clustering algorithms BIRCH and CURE. The results show that the approach not only produces high-quality results but also scales up very well by taking advantage of the Hadoop MapReduce paradigm or any distributed system.

Download

tahar Kechadi

Uploads

Papers by tahar Kechadi

Log In