• 한국정보통신학회:학술대회논문집
• /
• 한국해양정보통신학회 2001년도 추계종합학술대회
• /
• pp.541-544
• /
• 2001

ATM의 셀 트래픽을 TDMA 채널을 통하여 송수신하고자 할 때 ATM과 TDMA의 접속 및 변환과정에서 수신국에서 셀 지연 변이(CDV)가 발생하게 되는데, 이를 보상하기 위한 이산 타임스탬프 방식에 적용할 수 있는 최적화 방법과 이를 다중 타임스탬프 방식에 확대 적용하는 방법을 제시한다.

• 디지털산업정보학회논문지
• /
• 제10권2호
• /
• pp.91-105
• /
• 2014

This paper proposes a digital forensic method by an evaluation function based on timestamp changing patterns. Operations on file or folder leave changed timestamps, which give the ways to know what operations were executed. Changes of timestamps of ten operations of a file and eight operations of a folder were examined. Analyses on the changes on the eight folder operations are newly added in this paper, which are not performed in the previous works. Based on the timestamps changes of the file and the folder, two evaluation functions are proposed. The first evaluation function checks whether timestamps are changed by file and folder operations, and the second evaluation function checks whether timestamps are originated from a source file or other attribute field. By the two output values from these evaluation functions, a digital forensic investigation on the file or the folder is performed. With some cases, i. e. file copy and folder creation operations, the proposed forensic method is tested for its usefulness.

• International Journal of Internet, Broadcasting and Communication
• /
• 제8권3호
• /
• pp.31-40
• /
• 2016

In this paper, we propose a new anti-forensic method for hiding data in the timestamp of a file in the Windows NTFS filesystem. The main idea of the proposed method is to utilize the 16 least significant bits of the 64 bits in the timestamps. The 64-bit timestamp format represents a number of 100-nanosecond intervals, which are small enough to appear in less than a second, and are not commonly displayed with full precision in the Windows Explorer window or the file browsers of forensic tools. This allows them to be manipulated for other purposes. Every file has $STANDARD_INFORMATION and $FILE_NAME attributes, and each attribute has four timestamps respectively, so we can use 16 bytes to hide data. Without any changes in an original timestamp of "year-month-day hour:min:sec" format, we intentionally put manipulated data into the 16 least significant bits, making the existence of the hidden data in the timestamps difficult to uncover or detect. We demonstrated the applicability and feasibility of the proposed method with a test case.

• 한국정보처리학회논문지
• /
• 제7권9호
• /
• pp.2980-2993
• /
• 2000

B-ISDN 서비스를 신속하게 전개하기 위하여 지상 ATM과 위성망의 결합이 추진되고 있다. 이때 위성 TDMA와 ATM의 전달방식의 차이로 발생되는 셀 지연 변이(CDV)는 셀의 전송 품질을 저하시킨다. 본 논문에서는 기존의 CDV 보상 기법의 단점을 보완하는 부분 타임 스탬프 방식을 제안하였다. 이때 CDV를 최소화하고 위성 채널의 효율을 높이기 위해 부분 타임 스탬프의 최적화 개념을 도입하였다. 제안 기법의 성능을 평가하기 위하여 CDV 분포 폭을 평가 기준으로 하는 모의 실험을 통해 CDV 보상 성능의 우수함을 확인하였다.

• 한국컴퓨터정보학회논문지
• /
• 제23권8호
• /
• pp.75-84
• /
• 2018

In this research, a bit correction technique of data hiding method in timestamp of MFT entry in NTFS file system is proposed. This method is proposed in two ways, depending on the number of bytes of data to hide. A basic data hiding method using a bit correction technique to solve the problems of the conventional 2-byte technique is proposed. In order to increase the capacity of the data, a 3-byte data hiding method using an extended bit correction technique is proposed. The data hiding method in the timestamps is based on the fact that is not revealed in the Windows explorer window and the command prompt window even if any data is hidden in the timestamp area of less than one second. It is shown that the validity of the proposed method through the experimental two cases of the basic data hiding method by the bit correction method and the 3-byte data hiding method by the extended bit correction method.

• Journal of Information Processing Systems
• /
• 제18권3호
• /
• pp.402-410
• /
• 2022

Digital data can be manipulated easily, so information related to the timestamp is important in establishing the reliability of the data. The time values for a certain file can be extracted following the analysis of the filesystem metadata or file internals, and the information can be utilized to organize a timeline for a digital investigation. Suppose the reversal of a timestamp is found on a mobile device during this process. In this case, a more detailed analysis is required due to the possibility of anti-forensic activity, but little previous research has investigated the handling and possible manipulation of timestamps on mobile devices. Therefore, in this study, we determine how time values for multimedia files are handled according to the operating system or filesystem on mobile devices. We also discuss five types of timestamps-file created (C), last modified (M), last accessed (A), digitalized (Di), and filename (FN) of multimedia files, and experimented with their operational features across multiple devices such as smartphones and cameras.

• Journal of Communications and Networks
• /
• 제6권4호
• /
• pp.376-386
• /
• 2004

In ad hoc networks, loss-based congestion window progression by the traditional means of duplicate ACKs and timeouts causes high network buffer utilization due to large bursts of data, thereby degrading network bandwidth utilization. Moreover, network-oriented feedbacks to handle route disconnection events may impair packet forwarding capability by adding to MAC layer congestion and also dissipate considerable network resources at reluctant intermediate nodes. Here, we propose a new TCP scheme that does not require the participation of intermediate nodes. It is a purely end-to-end scheme using TCP timestamps to deduce link conditions. It also eliminates spurious reductions of the transmission window in cases of timeouts and fast retransmits. The scheme incorporates a receiver-oriented rate controller (rater), and a congestion window delimiter for the 802.11 MAC protocol. In addition, the transient nature of medium availability due to medium contention during the connection time is addressed by a freezing timer (freezer) at the receiver, which freezes the sender whenever heavy contention is perceived. Finally, the sender-end is modified to comply with the receiver-end enhancements, as an optional deployment. Simulation studies show that our modification of TCP for ad hoc networks offers outstanding performance in terms of goodput, as well as throughput.

• 한국인터넷방송통신학회논문지
• /
• 제17권2호
• /
• pp.7-13
• /
• 2017

용의자가 어떤 행위를 했는지 특정하기 위한 경우와 같이 디지털 조사에서 특정한 행위나 이벤트의 발생시간을 확인하기 위해 타임스팸프에 의존하는 시스템이 많다. 하지만 객체의 갱신은 실제 이벤트의 발생시점보다 약간의 시간차를 두고 이루어지게 된다. 이 논문에서는 타임스탬프와 관련된 객체를 가진 디지털시스템의 간단한 모델을 정의한다. 이 모델은 타임스탬프와 관련된 객체의 갱신 패턴을 예측하는데 사용되며 갱신 시간차 범위에 대한 예측을 가능하게 한다. 경험적 연구를 통해 타임스탬프 갱신패턴이 동시적이지 않다는 것을 보이고 특정한 시스템에서 보다 정확한 행위시점을 결정하기 위한 타임스탬프 갱신 분포를 계산하는 방법을 제시한다.

• ETRI Journal
• /
• 제31권4호
• /
• pp.466-468
• /
• 2009

In this letter, we propose a one-way ranging algorithm that is based on wireless synchronization with measured timestamps and clock frequency offsets. In our proposed algorithm, an active mobile node initiates a ranging procedure by transmitting a ranging frame, and the anchor nodes report their timestamps for the received ranging frame to a reference anchor node. The synchronization of a pair of nodes is provided with instantaneous time information, and the corresponding difference of distances can be calculated.

• 한국컴퓨터정보학회논문지
• /
• 제24권9호
• /
• pp.51-58
• /
• 2019

Temporal analysis is very useful and important for digital forensics for reconstructing the timeline of digital events. Forgery of a file's timestamp can lead to inconsistencies in the overall temporal relationship, making it difficult to analyze the timeline in reconstructing actions or events and the results of the analysis might not be reliable. The purpose of the timestamp change is to hide the data in a steganographic way, and the other purpose is for anti-forensics. In both cases, the time stamp change tools are requested to use. In this paper, we propose a classification method based on the behavior of the timestamp change tools. The timestamp change tools are categorized three types according to patterns of the changed timestamps after using the tools. By analyzing the changed timestamps, it can be decided what kind of tool is used. And we show that the three types of the patterns are closely related to API functions which are used to develop the tools.