Abstract:With the phenomenal growth of the Internet, more and more people enjoy and depend on the convenience of its provided services. Unfortunately, the number of network-based attacks is also increasing very quickly. More and more fraud activities appear in online advertising networks and online auction systems. Network attackers can easily hide their identities through IP spoofing, stepping stones, network address translators, Mobile IP or other ways, and thereby reduce the chance of being captured. The current IP network infrastructure lacks measures and cannot effectively deter and identify motivated and well-equipped attackers. Therefore, innovative traceback schemes are required to attribute the real attackers. By the way, network traffic always comes with high rate in distributed format without obvious beginning and ending. These properties make network traffic much different compared with traditional data sets, and data stream model is more feasible to analyze network traffic and detect anomaly and attacks. In this dissertation, we design effective techniques for detecting and attributing cyber criminals. We consider two kinds of fundamental techniques: forensics-sound attack monitoring and traceback, and forensics-sound online fraud detection. The contributions of our research are as follows: We propose several innovative algorithms which answer some open problems in fundamental statistics estimation over sliding windows. Those algorithms can be used to detect anomaly and attacks in networks. We also propose efficient and effective algorithms which can trace back stepping stone attacks and single packet attacks. Streaming algorithms are presented to detect click fraud in pay-per-click streams of online advertising networks.

Forensics Application of CUDA Distributed Computing

Data Processing and Applied Technology in the Algorithm and Cracking of NTLM-Hash - A Highly Proficient Parallel Computing Architecture

DDCFS: A Distributed Dynamic Computer Forensic System Based on Network

A digital evidence fusion method in network forensics systems with Dempster-shafer theory

Forensic Analysis of Distributed Computing Network Based on Decision Values

Design and Optimizations of the MD5 Crypt Cracking Algorithm Based on CUDA.

Cloud Computing Mode Network Crime Detection and Forensics Research

Effective techniques for detecting and attributing cyber criminals

On the application of digital forensics in different scenarios

Design and Performanc Optimization of Surveillance Video Inter-frame Forgery Detection System

A CUDA Based Implementation of an Image Authentication Algorithm

Cyber Crime Scene Investigations (C²SI) Through Cloud Computing.

A Program Behavior Study of Block Cryptography Algorithms on GPGPU

Computer Forensics Research and Implementation Based on NTFS File System

An Email Forensics Analysis Method Based on Social Network Analysis

Distributed Agent-Based Real Time Network Intrusion Forensics System Architecture Design

RCNF: Real-time Collaborative Network Forensic Scheme for Evidence Analysis

Electronic Evidence Service Research in Cloud Computing Environment.

Forensic Model for DDoS Attack

An Improved Kernel Clustering Algorithm for Mixed-Type Data in Network Forensic

GB-RC4: Effective brute force attacks on RC4 algorithm using GPU