Timing inference channels are a well-studied area of computer security and privacy research, but they have not been widely applied in digital forensic applications. Timing signatures (for example, of movies) are not robust against variations in the machine, the encoder, the environment, and other factors that affect timing, and unfortunately such issues have limited many researchers from using timing inference channels for revealing hidden data, detecting machine behavior, or even forensic analysis. The authors develop a geometrical interpretation in a high dimensional space of timing signatures for movies as an example of pattern-like software. The results suggest that timing signatures can be made robust against different machines, different encoders, and other environmental conditions by exploiting geometrical structure in this space. This geometrical structure helps identify the behavior of running pattern-like software that is useful for identifying digital crimes, privacy invasion matters, and network behaviors. This paper is focused on a thought experiment: how much information can an unprivileged process learn by just running on a system and observing its own timing? Although installing administrative software is the most frequent approach for understanding system behavior and detecting running software, the results show that it is feasible that such goals could be still achieved without any administrative privileges.<\/p>","DOI":"10.4018\/jdcf.2013010104","type":"journal-article","created":{"date-parts":[[2013,8,5]],"date-time":"2013-08-05T19:29:42Z","timestamp":1375730982000},"page":"54-69","source":"Crossref","is-referenced-by-count":0,"title":["Exploiting Geometrical Structure for Forensic Applications of Timing Inference Channels"],"prefix":"10.4018","volume":"5","author":[{"given":"Bilal","family":"Shebaro","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of New Mexico, Albuquerque, NM, USA"}]},{"given":"Fernando","family":"P\u00e9rez-Gonz\u00e1lez","sequence":"additional","affiliation":[{"name":"Signal Theory and Communications Department, University of Vigo, Vigo, Pontevedra, Spain"}]},{"given":"Jedidiah R.","family":"Crandall","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of New Mexico, Albuquerque, NM, USA"}]}],"member":"2432","reference":[{"key":"jdcf.2013010104-0","doi-asserted-by":"crossref","unstructured":"Agrawal, R., & Srikant, R. (2000). Privacy-preserving data mining. In Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data (pp. 439\u2013450). New York, NY: ACM. doi: http:\/\/doi.acm.org\/10.1145\/342009.335438","DOI":"10.1145\/335191.335438"},{"key":"jdcf.2013010104-1","unstructured":"Anand, R., Islam, N., Jaeger, T., & Rao, J. R. (1997). A flexible security model for using internet content. In Proceedings of the 16th Symposium on Reliable Distributed Systems. Washington, DC: IEEE Computer Society."},{"key":"jdcf.2013010104-2","unstructured":"Chaos Computer Club. (2011). Chaos Computer Club analyzes government malware. Retrieved from http:\/\/www.ccc.de\/en\/updates\/2011\/staatstrojaner"},{"key":"jdcf.2013010104-3","doi-asserted-by":"crossref","unstructured":"Chasanis, V., Kalogeratos, A., & Likas, A. (2009). Movie segmentation into scenes and chapters using locally weighted bag of visual words. In Proceedings of the acm international conference on image and video retrieval (pp. 35:1\u201335:7). New York, NY: ACM. doi: http:\/\/doi.acm.org\/10.1145\/1646396.1646439","DOI":"10.1145\/1646396.1646439"},{"key":"jdcf.2013010104-4","doi-asserted-by":"crossref","unstructured":"Chen, H.-W., Kuo, J.-H., Chu, W.-T., & Wu, J.-L. (2004). Action movies segmentation and summarization based on tempo analysis. In Proceedings of the 6th ACM SIGMM International Workshop on Multimedia Information Retrieval (pp. 251\u2013258). New York, NY: ACM. doi: http:\/\/doi.acm.org\/10.1145\/1026711.1026752","DOI":"10.1145\/1026711.1026752"},{"key":"jdcf.2013010104-5","doi-asserted-by":"crossref","unstructured":"Chua, T.-S., Tang, S., Trichet, R., Tan, H. K., & Song, Y. (2009). Moviebase: A movie database for event detection and behavioral analysis. In Proceedings of the 1st Workshop on Web-Scale Multimedia corpus (pp. 41\u201348). New York, NY: ACM. doi: http:\/\/doi.acm.org\/10.1145\/1631135.1631143","DOI":"10.1145\/1631135.1631143"},{"key":"jdcf.2013010104-6","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046770"},{"key":"jdcf.2013010104-7","article-title":"Privacy perserving data mining","author":"A.Evfimievski","year":"2007","journal-title":"Encyclopedia of database technologies and applications"},{"key":"jdcf.2013010104-8","doi-asserted-by":"publisher","DOI":"10.1145\/775047.775080"},{"key":"jdcf.2013010104-9","unstructured":"Guide to sun microsystems java plug-in security [Computer software manual]. (2003)."},{"key":"jdcf.2013010104-10","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-9868.2005.00510.x"},{"key":"jdcf.2013010104-11","unstructured":"Hurst, J. (n.d.). Comparison of java applets and activex controls. Retrieved from http:\/\/www.giac.org\/cissp-papers\/252.pdf"},{"key":"jdcf.2013010104-12","doi-asserted-by":"crossref","unstructured":"Ionescu, B., Vertan, C., Lambert, P., & Benoit, A. (2011). A color-action perceptual approach to the classification of animated movies. In Proceedings of the 1st ACM International Conference on Multimedia Retrieval (pp. 10:1\u201310:8). New York, NY: ACM. doi: http:\/\/doi.acm.org\/10.1145\/1991996.1992006","DOI":"10.1145\/1991996.1992006"},{"key":"jdcf.2013010104-13","doi-asserted-by":"publisher","DOI":"10.4018\/978-1-59140-872-7"},{"key":"jdcf.2013010104-14","unstructured":"Laurant, C. (2003). Privacy international: Privacy and human rights 2003: An international survey of privacy laws and developments. Electronic Privacy Information Center (EPIC). http:\/\/epic.org\/bookstore\/phr2003\/."},{"key":"jdcf.2013010104-15","unstructured":"MARE. J. M. (2002). Risks of java applets and Microsoft Activex controls (Tech. Rep.). Bethesda, MD: Sans Institute."},{"key":"jdcf.2013010104-16","unstructured":"McCullagh, D. (2010). Police want backdoor to web users\u2019 private data. Retrieved from http:\/\/news.cnet.com\/8301-13578_3-10446503-38.html"},{"key":"jdcf.2013010104-17","author":"S.Oaks","year":"1998","journal-title":"Java security"},{"key":"jdcf.2013010104-18","doi-asserted-by":"publisher","DOI":"10.1145\/339647.339656"},{"issue":"1","key":"jdcf.2013010104-19","first-page":"41","article-title":"Covert channel forensics on the internet: Issues, approaches, and experiences.","volume":"5","author":"A.Patel","year":"2007","journal-title":"International Journal of Network Security"},{"key":"jdcf.2013010104-20","unstructured":"Prabhu, R. P. (2003). Child pornography on the internet, federal laws and corporate responsibility. The SANS Institute. Retrieved from www.giac.org\/paper\/gsec\/2949\/child-pornography-internet-federal-laws-corporate-responsibility\/104960."},{"key":"jdcf.2013010104-21","unstructured":"Tsafrir, D., Etsion, Y., & Feitelson, D. G. (2007). Secretly monopolizing the CPU without superuser privileges. In Proceedings of 16th Usenix Security Symposium on Usenix Security Symposium (pp. 17:1\u201317:18). Berkeley, CA: USENIX Association."},{"key":"jdcf.2013010104-22","doi-asserted-by":"publisher","DOI":"10.1109\/ICNSC.2007.372786"},{"key":"jdcf.2013010104-23","doi-asserted-by":"publisher","DOI":"10.1016\/j.datak.2010.08.004"}],"container-title":["International Journal of Digital Crime and Forensics"],"original-title":[],"language":"ng","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=79141","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T19:47:54Z","timestamp":1654112874000},"score":1,"resource":{"primary":{"URL":"https:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/jdcf.2013010104"}},"subtitle":[""],"short-title":[],"issued":{"date-parts":[[2013,1,1]]},"references-count":24,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2013,1]]}},"URL":"https:\/\/doi.org\/10.4018\/jdcf.2013010104","relation":{},"ISSN":["1941-6210","1941-6229"],"issn-type":[{"value":"1941-6210","type":"print"},{"value":"1941-6229","type":"electronic"}],"subject":[],"published":{"date-parts":[[2013,1,1]]}}}