Mihai Lazarescu

Cloud forensics

Cloud computing is arguably one of the most significant advances in information technology (IT) services today. Several cloud service providers (CSPs) have offered services that have produced various transformative changes in computing activities and presented numerous promising technological and economic opportunities. However, many cloud customers remain reluctant to move their IT needs to the cloud, mainly due to their concerns on cloud security and the threat of the unknown. The CSPs indirectly escalate their concerns by not letting customers see what is behind virtual wall of their clouds that, among others, hinders digital investigations. In addition, jurisdiction, data duplication and multi-tenancy in cloud platform add to the challenge of locating, identifying and separating the suspected or compromised targets for digital forensics. Unfortunately, the existing approaches to evidence collection and recovery in a non-cloud (traditional) system are not practical as they rely on unrestricted access to the relevant system and user data; something that is not available in the cloud due its decentralized data processing. In this paper we systematically survey the forensic challenges in cloud computing and analyze their most recent solutions and developments. In particular, unlike the existing surveys on the topic, we describe the issues in cloud computing using the phases of traditional digital forensics as the base. For each phase of the digital forensic process, we have included a list of challenges and analysis of their possible solutions. Our description helps identifying the differences between the problems and solutions for non-cloud and cloud digital forensics. Further, the presentation is expected to help the investigators better understand the problems in cloud environment. More importantly, the paper also includes most recent development in cloud forensics produced by researchers, National Institute of Standards and Technology and Amazon.

Effective Anomaly Detection in Sensor Networks Data Streams

—This paper addresses a major challenge in data mining applications where the full information about the underlying processes, such as sensor networks or large online database, cannot be practically obtained due to physical limitations such as low bandwidth or memory, storage, or computing power. Motivated by the recent theory on direct information sampling called compressed sensing (CS), we propose a framework for detecting anomalies from these large-scale data mining applications where the full information is not practically possible to obtain. Exploiting the fact that the intrinsic dimension of the data in these applications are typically small relative to the raw dimension and the fact that compressed sensing is capable of capturing most information with few measurements, our work show that spectral methods that used for volume anomaly detection can be directly applied to the CS data with guarantee on performance. Our theoretical contributions are supported by extensive experimental results on large datasets which show satisfactory performance.

Recognising faces in unseen modes: A tensor based approach

This paper addresses the limitation of current multilinear techniques (multilinear PCA, multilinear ICA) when applied to face recognition for handling faces in unseen illumination and viewpoints. We propose a new recognition method, exploiting the interaction of all the subspaces resulting from multilinear decomposition (for both multilinear PCA and ICA), to produce a new basis called multilinear-eigenmodes. This basis offers the flexibility to handle face images at unseen illumination or viewpoints. Experiments on benchmarked datasets yield superior performance in terms of both accuracy and computational cost.

Efficient heuristics for energy-aware routing in networks with bundled links

Abstract Current networks are typically over-provisioned to ensure low delays, redundancy and reliability. These Quality of Service (QoS) guarantees are typically achieved using high end, high power network equipments. Their use, however, has led to concerns regarding green house gas emissions, which garnered a lot of attention recently and have resulted in a number of global initiatives aim at reducing the carbon footprint of Internet Service Providers (ISPs). These initiatives have motivated ISPs and researchers to design novel network algorithms and hardware that scale the usage or active time of a network according to traffic load. To this end, this paper considers the problem of shutting down a subset of bundled links during off-peak periods in order to minimize energy expenditure. Unfortunately, identifying the cables that minimize this objective is an NP-complete problem. Henceforth, we propose several practical heuristics based on Dijkstra’s algorithm and Yen’s k-shortest paths algorithm. We evaluated our heuristics on the Abilene network – with both real and synthetic traffic matrices and several larger random topologies with various loads. Our results show that the proposed heuristics to be effective and efficient. Moreover, our approaches could potentially reduce the energy usage of cables used in the Abilene network by up to 56.7%, assuming the traffic demands recorded on September 5, 2004.

Using camera motion to identify types of American football plays

This paper presents a method that uses camera motion parameters to recognise 7 types of American football plays. The approach is based on the motion information extracted from the video and it can identify short and long pass plays, short and long running plays, quarterback sacks, punt plays and kickoff plays. This method has the advantage that it is fast and it does not require player or ball tracking. The system was trained and tested using 782 plays and the results show that the system has an overall classification accuracy of 68%.

Graph Matching: Fast Candidate Elimination Using Machine Learning Techniques

Graph matching is an important class of methods in pattern recognition. Typically, a graph representing an unknown pattern is matched with a database of models. If the database of model graphs is large, an additional factor in induced into the overall complexity of the matching process. Various techniques for reducing the influence of this additional factor have been described in the literature. In this paper we propose to extract simple features from a graph and use them to eliminate candidate graphs from the database. The most powerful set of features and a decision tree useful for candidate elimination are found by means of the C4.5 algorithm, which was originally proposed for inductive learning of classification rules. Experimental results are reported demonstrating that efficient candidate elimination can be achieved by the proposed procedure.

On the automatic indexing of cricket using camera motion parameters

This paper describes an application of camera motion estimation to index cricket games. The shots are labeled with the type of shot: glance left, glance right, left drive, right drive, left cut, right pull and straight drive. The method has the advantages that it is fast and avoids complex image segmentation. The classification of the cricket shots is done using an incremental learning algorithm. We tested the method on over 600 shots and the results show that the system has a classification accuracy of 74%.

On the automated interpretation and indexing of American Football

Combines natural language understanding and image processing with incremental learning to develop a system that can automatically interpret and index American Football. We have developed a model for representing spatio-temporal characteristics of multiple objects in dynamic scenes in this domain. Our representation combines expert knowledge, domain knowledge, spatial knowledge and temporal knowledge. We also present an incremental learning algorithm to improve the knowledge base as well as to keep previously developed concepts consistent with new data. The advantages of the incremental learning algorithm are that is that it does not split concepts and it generates a compact conceptual hierarchy which does not store instances.

Detection and Monitoring of Passengers on a Bus by Video Surveillance

This paper presents a method to detect passengers onboard public transport vehicles. The method comprises first an elliptical head detection algorithm using the curvature profile of the human head as a cue. This is followed by applying the geometric blur features which are consistent to affine distortion of the image to keep track of the movement of the head within the vehicle. The profile of the moving heads with respect to each other within a length of time can then be used as indicative features to detect the advent of suspicious behaviour of the passengers.

Energy Aware Two Disjoint Paths Routing

Network robustness and throughput can be improved by routing each source-to-terminal (sd, td) demand d via two disjoint paths (2DP). However, 2DP routing increases energy usage despite yielding lower link utilization and higher redundancy. In this paper, we address the problem of minimizing the energy usage of networks that use 2DP. Specifically, our problem, called Energy-Aware Two Disjoint Paths Routing (EAR-2DP), is to maximally switch off redundant links while guaranteeing at least 0≤T≤1.0 fraction of all possible (sd, td) 2DPs remain on and their maximum link utilization (MLU) is no greater than a configured threshold. We first prove that EAR-2DP is NP-complete. Then, we design a fast heuristic solution, called Two Disjoint Paths by Shortest Path (2DP-SP). We have extensively evaluated the performance of 2DP-SP on real and/or synthetic topologies and traffic demands with two link-disjoint paths (2DP-L) and two node-disjoint paths (2DP-N). Our simulation results show that 2DP-SP can reduce network energy usage, on average, by more than 20%, even for MLU below 50%. As compared to using Shortest Path (SP) routing, while reducing energy by about 20%, 2DP-SP does not significantly affect the path length of each (sd, td) demand, even for MLU<50%. Furthermore, almost 94.2% of routes produced by 2DP-SP have route reliability up to 35% higher as compared to SP and up to 50% of the routes are only 5% less reliable than those of 2DP routing without energy savings.