Kyungsoo Lim

Detecting Similar Files Based on Hash and Statistical Analysis for Digital Forensic Investigation

In modern society, rapid increase in using mass storage devices, and it makes forensic examiners find important evidence hardly in the focus of time-consuming. Examiners spend much time to search files related to the case in variety of storage devices. Recently, NIST(National Institute of Standards and Technology) has developed a new database, called NSRL(National Software Reference Library), which contains hash values of trusted operating systems and programs(1). As establishing this database service in public, NIST contribute to reduce time-consuming in searching file and detecting forgery on the devices. On the other hand, the hash value based detection technique cannot be distinguished the similarity from other files perfectly. In this paper, therefore, we present novel methods for detecting similar files considering the known fuzzy hashing and statistical analysis and developed out prototype tool, called SimFD.

Power saving mobility protocol for sensor network

Recently, the advancement of the development technologies for the smart sensor nodes that are small, low-power devices with abilities of environment sensing, data computing and wireless communication facilitates research for the wireless sensor network. Wireless sensor networks (WSN) are networks composed of such sensor nodes that have abilities to monitor and control the physical environment from the remote locations. Such networks make many applications possible in the scientific, medical, commercial, and military domains, for example, surveillance, smart home and offices, environment monitoring, and many others. We present wireless sensor network architecture. Its basic operations, sensor ID assignment scheme and ID creation algorithm, and mobility protocol for the management of the sensor or relay nodes movement. We also suggest a power management scheme of our wireless sensor network architecture.

A Methodology for Forensic Analysis of Embedded Systems

An embedded system is a special-purpose computer system designed to perform one or a few dedicated functions, for example, just portable devices such as MP3 players, cell phone, PDA, to telemetric system like car navigation system etc. The more embedded systems are diversifying various types, the more forensic community is concentrating on efforts of research correspond to all kinds of embedded systems. Forensic analysis of embedded systems will become an area of increasing significance in the near future. Clearly, the growing use of embedded systems and the ubiquitous age is required advanced digital forensic techniques for the future forensic computing. In this paper, we introduce new emerging embedded systems and show a comprehensive methodology for forensic analysis of embedded systems.

A localized route discovery for on-demand routing protocols in event-driven wireless sensor networks

In this paper, the problem of Redundant Duplicated RREQ Network-wide Flooding (RDRNF), induced by multiple sensor nodes during route discovery in event-driven wireless sensor networks, is described. In order to reduce the number of signaling messages during the route discovery phase, a novel extension, named the Localized Route Discovery Extension (LRDE), to the on-demand ad hoc routing protocol, is proposed. The LRDE reduces energy consumption during route discovery. The heuristically and temporarily selected Path Set-up Coordinator (PSC) plays the role of a route request broker that alleviates redundant route request flooding. The LRDE also sets a route path be aggregation-compatible. The PSC can effectively perform data aggregation through the routing path constructed by the LRDE. The simulation results reveal that significant energy is conserved by reducing signaling overhead and performing data aggregation when LRDE is applied to on-demand routing protocols.

Time-Synchronized Neighbor Nodes Based Redundant Robust Routing (TSN2R3) for Mobile Sensor Networks

This paper proposes a new on-demand redundant-path routing protocol considering time synchronization based path redundancy as one of route selection criteria. Path redundancy implies how many possible redundant paths may exist on a route to be built up. Our proposal aims to establish a route that contains more redundant paths toward the destination by involving intermediate nodes with relatively mode adjacent nodes in a possible route. Our approach can localize the effects of route failures, and reduce control traffic overhead and route reconfiguration time by enhancing the reachability to the destination node without source-initiated route re-discoveries at route failures. We have evaluated the performance of our routing scheme through a series of simulations using the Network Simulator 2 (ns-2).

A Stepwise Methodology for Tracing Computer Usage

In digital forensics investigation, a general method of investigating the suspect’s computer was to duplicate storage media or image and then obtain the case-related data from these. However, the increase in the capacity of storage media made this method take much longer time. Also, this implies that more data can exist in the suspect’s computer so that finding relevant data will take a lot of time and efforts. Moreover, in case where imaging of the entire disk is not possible dueto legal matters, selective acquisition of data is needed. In this paper, we propose methods for selective acquisition offile system metadata, registry and prefetch files, web browserfiles, specific document files without duplicating or imaging the storage media. Furthermore, we suggest a method to analyze the acquired data stepwise and quickly and effectively trace the use of computer in the crime scene.

Implementation and Performance Analysis of an IPv6 Multicast Forwarder for the IXP2400 Network Processor

This paper describes the design and implementation of an IPv6 multicast forwarder as the preliminary step for developing a high-speed IPv6 multicast-enabled router for use in an environment where multicast packets occupy some portion of the total network traffic using the programmable IXP2400 network processor. We validate our implementation and evaluate its performance with hardware experiments. Our experimental results show that the measured forwarding rate is 86% of full line rate in the minimum IPv6 packet size and the latency of IPv6 multicast packet forwarding compared with IPv6 unicast increases 25% in average. These are due to the processing overhead of IPv6 multicast route lookup in IPv6 multicast forwarder microblock, the packet copy in packet replication microblock, and the packet buffer management in packet TX microblock

Service Migration Mechanism Using Mobile Sensor Network

The recent advancement of wireless communication technology provides us with new opportunities, but it initiates new challenges and demands as well. Especially, there is an increasing demand for supporting user mobility and service mobility transparently. In this paper, we propose a new mechanism for service migration based on sensor networks of wireless sensor nodes. This mechanism is composed of a component-based server-side model for service mobility and Mobile IP technology for supporting user mobility among sensor networks.

The Analyst of Inavi Navigation user Information by Digital Forensic

The operated type of navigation is composed of hardware or software. The navigation based on software is stored and ran in the external storage(e.g. SD card). For the convenience of users, Many car navigation systems store user information such as frequently visited place, route, and so on. Those can be used to proving the alibi of users as well as their relationship between the actual owner of the vehicle through data and time information analysis. Therefore, if it is analyzed datas of navigation, we can get a lot of information such as user`s movement, route of car. There are important implications in the digital forensics because it`s available for investigating the various crimes. This paper demonstrates the necessary information in the digital investigation through the analysis of stored data in the navigation.

Zone based data aggregation scheduling scheme for maximizing network lifetime

Awireless sensor network consists of many micro-sensor nodes distributed throughout an area of interest. Each node has a limited energy supply and generates information that needs to be communicated to a sink node.The basic operation in such a network is the systematic gathering and transmission of sensed data to a base station for further processing. During data gathering, sensors have the ability to perform in-network aggregation (fusion) of data packet routes to the base station. The lifetime of such a sensor system can be defined as the time during which the sensor information is gathered from all of the sensors and combined at the base station. Given the location of the sensors, the base station and the available energy at each sensor, the main interest is to find an efficientmanner in which data can be collected from the sensors and transmitted to the base station, so as to maximize the system lifetime.We address the zone based data aggregation scheduling scheme for maximizing network lifetime. The experimental results demonstrate that the proposed protocol significantly outperforms other data aggregation protocols in terms of the energy saving and system lifetime.