• Journal of Internet of Things and Convergence
• /
• v.9 no.6
• /
• pp.23-28
• /
• 2023

Windows operating system generates various logs with timestamps. Timestamp tampering is an act of anti-forensics in which a suspect manipulates the timestamps of data related to a crime to conceal traces, making it difficult for analysts to reconstruct the situation of the incident. This can delay investigations or lead to the failure of obtaining crucial digital evidence. Therefore, various techniques have been developed to detect timestamp tampering. However, there is a limitation in detection if a suspect is aware of timestamp patterns and manipulates timestamps skillfully or alters system artifacts used in timestamp tampering detection. In this paper, a method is designed to detect changes in timestamps, even if a suspect alters the timestamp of a file on a storage device, it is challenging to do so with precision beyond millisecond order. In the proposed detection method, the first step involves verifying the timestamp of a file suspected of tampering to determine its write time. Subsequently, the confirmed time is compared with the file size recorded within that time, taking into consideration the performance of the storage device. Finally, the total capacity of files written at a specific time is calculated, and this is compared with the maximum input and output performance of the storage device to detect any potential file tampering.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.21 no.10
• /
• pp.1840-1848
• /
• 2017

Linear wireless sensor networks typically construct a network topology with a high reliability through sequential 1:1 mapping among sensor nodes, so that they are used in various surveillance applications of major national infrastructures. Most existing techniques for identifying sensor nodes in those networks are using GPS, AOA, and RSSI mechanisms. However, GPS or AOA based node identification techniques affect the size or production cost of the nodes so that it is not easy to construct practical sensor networks. RSSI based techniques may have a high deviation regrading location identification according to propagation environments and equipment quality so that complexity of error correction algorithm may increase. We propose a timestamps based sequential localization algorithm that uses transmit and receive timestamps in a message between sensor nodes without using GPS, AOA, and RSSI techniques. The algorithms for distance measurement between each node are expected to measure distance within up to 1 meter in case of an crystal oscillator of 300MHz or more.

• Journal of information and communication convergence engineering
• /
• v.6 no.2
• /
• pp.182-186
• /
• 2008

RFID systems generate huge amount of data quickly. The data are associated with the locations and the timestamps and the containment relationships. It is requires to assure efficient queries and updates for product tracking and monitoring. We propose a clustering technique for fast query processing. Our study presents the state charts of temporal event flow and proposes the dependence trees with data association and uses them to cluster the linked events. Our experimental evaluation show the power of proposing clustering technique based on dependence tree.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.4 no.2
• /
• pp.323-336
• /
• 2000

In order to achieve the deployment of B-ISDN services in a short time, B-ISDN is being combined with terrestrial ATM network and satellite network which covers a widespread service range. This paper analyzes and investigates several previously existent CDV compensation methods in order to compensate CDV arising from interfacing satellite TDMA and ATM. Specifically to supplement the problems of timestamp and cell number counting methods, new Partial Timestamp mechanism for CDV compensation is proposed. The CDV compensating efficiency of the proposed mechanism is analyzed and evaluated by simulations. It goes to show that Partial timestamps mechanism has many advantages in the aspect of the CDV compensation.

• ETRI Journal
• /
• v.22 no.3
• /
• pp.1-9
• /
• 2000

Self-Clocked Fair Queueing (SCFQ) algorithm has been considered as an attractive packet scheduling algorithm because of its implementation simplicity, but it has unbounded delay property in some input traffic conditions. In this paper, we propose a Rate Proportional SCFQ (RP-SCFQ) algorithm which is a rate proportional version of SCFQ. If any fair queueing algorithm can be categorized into the rate proportional class and input is constrained by a leaky bucket, its delay is bounded and the same as that of Weighted Fair Queueing (WFQ) which is known as an optimal fair queueing algorithm. RP-SCFQ calculates the timestamps of packets arriving during the transmission of a packet using the current value of system potential updated at every packet departing instant and uses a starting potential when it updates the system potential. By doing so, RP-SCFQ can have the rate proportional property. RP-SCFQ is appropriate for high-speed packet-switched networks since its implementation complexity is low while it guarantees the bounded delay even in the worst-case input traffic conditions.

• Journal of Korea Multimedia Society
• /
• v.20 no.7
• /
• pp.1030-1037
• /
• 2017

Traffic flows of real-time multimedia services such as Internet phone and IPTV are bounded on the end-to-end delay. Packets violating their delay limits will be dropped at a router because of not useful anymore. Service providers promise the quality of their providing services in terms of SLA(Service Level Agreement), and they, especially, have to guarantee the packet loss rates listed in the SLA. This paper is about a method to guarantee the required packet loss rate of each traffic flow keeping the high network resource utilization as well. In details, it assures the required loss rate by adjusting adaptively the timestamps of packets of the flow according to the difference between the required and measured loss rates in the lossy Weighted Fair Queuing(WFQ) scheduler. The proposed method is expected to be highly applicable because of assuring the packet loss rates regardless of the fluctuations of offered traffic load in terms of quality of services and statistical characteristics.

• Journal of the Korea Society of Computer and Information
• /
• v.12 no.4
• /
• pp.77-85
• /
• 2007

Asecure channel provides protection against interception, while an authentication system is created to protect the client and the server from fabrication attacks. This paper proposes a hybrid authentication algorithm, which fixes the lapses problem encountered in the SSL authentication. Also, the Proposed hybrid authentication system has been created to protect the client and the server from modification and fabrication attacks. By using a modified three-way authentication there is no need for a timeserver. thus timestamps are not needed.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.11 no.2
• /
• pp.73-90
• /
• 2015

When we apply file commands on files in a directory, the directory as well as the file suffer changes in timestamps of MFT entry. Based on understanding of these changes, this work provides a digital forensic analysis on the timestamp changes of the directory influenced by execution of file commands. NTFS utilizes B-tree indexing structure for managing efficient storage of a huge number of files and fast lookups, which changes an index tree of the directory index when files are operated by commands. From a digital forensic point of view, we try to understand behaviors of the B-tree indexes and are looking for traces of files to collect information. But it is not easy to analyze the directory index entry when the file commands are executed. And researches on a digital forensic about NTFS directory and B-tree indexing are comparatively rare. Focusing on the fact, we present, in this paper, directory timestamp changes after executing file commands including a creation, a copy, a deletion etc are analyzed and a method for finding forensic evidences of a deletion of directory containing files. With some cases, i.e. examples of file copy and file deletion command, analyses on the problem of timestamp changes of the directory are given and the problem of finding evidences of a deletion of directory containging files are shown.

• The Journal of the Korea Contents Association
• /
• v.7 no.10
• /
• pp.27-35
• /
• 2007

Radio Frequency Identification(RFID) technology is set to play an essential role in object tracking or supply chain management systems. New challenges for RFID data management are needed in the RFID applications. RFID data are generated quickly and automatically, and can be used for object tracking, or for real-time monitoring. These applications are mostly associated with the timestamps when the events happen. In this paper, we propose a temporal RFID data model to maintain the history of events and state changes and to monitor the states of RFID objects. Also we propose data filtering method of non active data based on temporal RFID data model. This data model involves essential basic operations for RFID data. We show increased query performance through the data filtering method of non active data.

• Journal of Computing Science and Engineering
• /
• v.5 no.4
• /
• pp.294-304
• /
• 2011

Enhancing continuous queries over data streams with temporal functions and predicates enriches the expressive power of those queries. While traditional continuous queries retrieve only the values of attributes, temporal continuous queries retrieve the valid time intervals of those values as well. Correctly evaluating such queries requires the coalescing of adjacent timestamps for value-equivalent tuples prior to evaluating temporal functions and predicates. For many stream applications, the available computing resources may be too limited to produce exact query results. These limitations are commonly addressed through load shedding and produce approximated query results. There have been many load shedding mechanisms proposed so far, but for temporal continuous queries, the presence of coalescing makes theses existing methods unsuitable. In this paper, we propose a new accuracy metric and load shedding algorithm that are suitable for temporal query processing when memory is insufficient. The accuracy metric uses a combination of the Jaccard coefficient to measure the accuracy of attribute values and $\mathcal{PQI}$ interval orders to measure the accuracy of the valid time intervals in the approximate query result. The algorithm employs a greedy strategy combining two objectives reflecting the two accuracy metrics (i.e., value and interval). In the performance study, the proposed greedy algorithm outperforms a conventional random load shedding algorithm by up to an order of magnitude in its achieved accuracy.