Prof Bill Buchanan OBE FRSE

Edinburgh, Scotland, United Kingdom Contact Info
39K followers 500+ connections

Join to view profile

About

Bill is a Professor of Applied Cryptography in the School of Computing, Engineering and…

Articles by Prof Bill

See all articles

Activity

Join now to see all activity

Experience & Education

  • Napier University

View Prof Bill’s full experience

By clicking Continue to join or sign in, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy.

Licenses & Certifications

  • PhD

    -

Publications

  • Fast contraband detection in large capacity disk drives.

    Digital Investigator

    In recent years the capacity of digital storage devices has been increasing at a rate that has left digital forensic services struggling to cope. There is an acknowledgement that current forensic tools have failed to keep up. The workload is such that a form of ‘administrative triage’ takes place in many labs where perceived low priority jobs are delayed or dropped without reference to the data itself. In this paper we investigate the feasibility of first responders performing a fast initial…

    In recent years the capacity of digital storage devices has been increasing at a rate that has left digital forensic services struggling to cope. There is an acknowledgement that current forensic tools have failed to keep up. The workload is such that a form of ‘administrative triage’ takes place in many labs where perceived low priority jobs are delayed or dropped without reference to the data itself. In this paper we investigate the feasibility of first responders performing a fast initial scan of a device by sampling on the device itself. A Bloom filter is used to store the block hashes of large collections of contraband data. We show that by sampling disk clusters, we can achieve 99.9% accuracy scanning for contraband data in minutes. Even under the constraints imposed by low specification legacy equipment, it is possible to scan a device for contraband with a known and controllable margin of error in a reasonable time. We conclude that in this type of case it is feasible to boot the device into a forensically sound environment and do a pre-imaging scan to prioritise the device for further detailed investigation.

    Other authors
    See publication

  • Approaches to the Classification Of High Entropy File Fragments

    Digital Investigator, Elsevier

    In this paper we propose novel approaches to the problem of classifying high entropy file fragments. Although classification of file fragments is central to the science of Digital Forensics, high entropy types have been regarded as a problem. Roussev and Garfinkel (2009) argue that existing methods will not work on high entropy fragments because they have no discernible patterns to exploit. We propose two methods that do not rely on such patterns. The NIST statistical test suite is used to…

    In this paper we propose novel approaches to the problem of classifying high entropy file fragments. Although classification of file fragments is central to the science of Digital Forensics, high entropy types have been regarded as a problem. Roussev and Garfinkel (2009) argue that existing methods will not work on high entropy fragments because they have no discernible patterns to exploit. We propose two methods that do not rely on such patterns. The NIST statistical test suite is used to detect randomness in 4 KiB fragments. These test results were analysed using an Artificial Neural Network (ANN). Optimum results were 91% and 82% correct classification rates for encrypted and compressed fragments respectively. We also use the compressibility of a fragment as a measure of its randomness. Correct classification was 76% and 70% for encrypted and compressed fragments respectively.We show that newer more efficient compression formats are more difficult to classify.We have used subsets of the publicly available ‘GovDocs1 Million File Corpus’ so that any future research may make valid comparisons with the results obtained here.

    Other authors
    See publication

  • Case Study: Moving Towards an e-health Platform to Store NHS Patient Information in the Cloud

    Cloud Computing in the Public Sector: The Way Forward, London.

    Case Study: Moving Towards an e-health Platform to Store NHS Patient Information in the Cloud

    The NHS pilot scheme to store patient information in the Cloud
    How can the health sector can gain greater value from its infrastructure by moving services into the cloud
    Harnessing maximum benefits out of cloud computing
    What will make cloud services compelling for every NHS organisation?
    Increasing operational efficiency and reducing costs in the health sector
    Providing NHS…

    Case Study: Moving Towards an e-health Platform to Store NHS Patient Information in the Cloud

    The NHS pilot scheme to store patient information in the Cloud
    How can the health sector can gain greater value from its infrastructure by moving services into the cloud
    Harnessing maximum benefits out of cloud computing
    What will make cloud services compelling for every NHS organisation?
    Increasing operational efficiency and reducing costs in the health sector
    Providing NHS patients with complete control over their medical records and the power to decide who can access their data
    Overcoming the security and confidentiality problems

    Other authors
    See publication

  • Case Study: Moving Towards an e-health Platform to Store NHS Patient Information in the Cloud

    Cloud Computing in the Public Sector: The Way Forward, London.

    Case Study: Moving Towards an e-health Platform to Store NHS Patient Information in the Cloud

    The NHS pilot scheme to store patient information in the Cloud
    How can the health sector can gain greater value from its infrastructure by moving services into the cloud
    Harnessing maximum benefits out of cloud computing
    What will make cloud services compelling for every NHS organisation?
    Increasing operational efficiency and reducing costs in the health sector
    Providing NHS…

    Case Study: Moving Towards an e-health Platform to Store NHS Patient Information in the Cloud

    The NHS pilot scheme to store patient information in the Cloud
    How can the health sector can gain greater value from its infrastructure by moving services into the cloud
    Harnessing maximum benefits out of cloud computing
    What will make cloud services compelling for every NHS organisation?
    Increasing operational efficiency and reducing costs in the health sector
    Providing NHS patients with complete control over their medical records and the power to decide who can access their data
    Overcoming the security and confidentiality problems

    Other authors
    See publication

  • A Novel Privacy Preserving Method for the Location Tracking of Mobile Devices.

    The Journal of Mobile Communication, Computation and Information: Special Issue on Security,

    Two of the major changes within computing, at the present time, are the move towards service-oriented architectures and the increasing usage of mobile devices to access these services. Along with this, as these devices are often moving, extra context information can be provided to a service, if the user is known, along with their actual location and their current trajectory. This includes useful applications such as providing the nearest bus stop to a user, and thus to show the buses which are…

    Two of the major changes within computing, at the present time, are the move towards service-oriented architectures and the increasing usage of mobile devices to access these services. Along with this, as these devices are often moving, extra context information can be provided to a service, if the user is known, along with their actual location and their current trajectory. This includes useful applications such as providing the nearest bus stop to a user, and thus to show the buses which are due to arrive next. While this type of information is useful to the user for services that are trusted, there can be many issues related to the gathering of location information for non-trusted applications, such as for location-based marketing, or for user behaviour profiling. With simple security controls being applied to the access of the location information from mobile devices, it is important that users understand how their location information is being used. This paper reviews some of the current methods which are being proposed in order to reduce the impact of location tracking on user privacy.

    Other authors
    See publication

  • Validation of 1-N OT Algorithms in Privacy-Preserving Investigations

    7th European Conference on Information Warfare and Security

    Most organisations relay on digital information systems (ISs) in day-to-day operations, and often sensitive data about employees and customers are stored in such systems. This, effectively, makes ISs enhanced surveillance measures, which can reach further than CCTV monitoring and provide valuable resources for internal and external investigations. For privacy reasons, if a digital forensic investigation is to take place, only the investigators should know the identities of the suspects…

    Most organisations relay on digital information systems (ISs) in day-to-day operations, and often sensitive data about employees and customers are stored in such systems. This, effectively, makes ISs enhanced surveillance measures, which can reach further than CCTV monitoring and provide valuable resources for internal and external investigations. For privacy reasons, if a digital forensic investigation is to take place, only the investigators should know the identities of the suspects. Ideally, the investigators should not have to disclose these identities to the data holders, while the data holders, i.e. organisations whose data subjects are being investigated, should not have to disclose their full databases to investigators. The only data that should be disclosed should relate to that involving the subject – thus the need for a privacy-preserving investigation system. Several privacy preserving algorithms have been proposed, but most of them are only of theoretical interest since empirical evaluations have rarely been undertaken. The main novelty in this paper is that it applies a 1-out-n Oblivious Transfer (1-n OT) algorithm to a new area of privacy-preserving investigations. Hence, an implementation of a straightforward privacy-preserving investigation system that can be used in real-life applications is outlined. The system uses tried and tested encryption algorithms: RSA for hiding the identity of the suspect; AES to conceal from investigators records not relating to the suspect; and commutative RSA to allow discovery of index where a suspect’s data is stored in the third party records. This paper outlines an initial evaluation of the system proving that it may be successfully used in digital forensic investigations, conducted by public authorities and private organisations alike.

    Other authors
    See publication

  • Towards a Framework For Evaluating System Call Data as a Source of Digital Forensic Evidence

    The 2nd Conference on Advances in Computer Security and Forensics

    Other authors

  • A New Efficient Distributed Route Discovery for Wireless Mobile Ad hoc Networks

    IEEE Communication Society.

    High performance group communication, such as broadcast, requires matching efficient broadcast algorithms to effective route discovery approach. Broadcast communication in MANETs is essential for a wide range of important applications. Nevertheless, existing broadcast schemes in MANETs suffer in terms of several issues such as rebroadcast redundancy and collisions. Consequently, this degrades the communication quality especially when dealing with high bandwidth applications. Thus, this paper…

    High performance group communication, such as broadcast, requires matching efficient broadcast algorithms to effective route discovery approach. Broadcast communication in MANETs is essential for a wide range of important applications. Nevertheless, existing broadcast schemes in MANETs suffer in terms of several issues such as rebroadcast redundancy and collisions. Consequently, this degrades the communication quality especially when dealing with high bandwidth applications. Thus, this paper adopts a new strategy that presents a new distributed route discovery (DRD) scheme to handle the broadcast operation efficiently by reducing the number of the broadcast redundancy request (RREQ) packets and the number of collision and contentions. We examined the performance of the proposed scheme DRD in MANETs; in terms of RREQ rebroadcast number and RREQ collision number. Our experiments confirm the superiority of the proposed scheme over its counterparts in different communication constraints.

    Other authors
    See publication

Patents

  • Resilient secret sharing cloud based architecture for data vault

    Filed US US 2017/000579

    A method of securely storing data including: providing, within a secure data storage system, a plurality of secret sharing methods for selection and identifying a striping policy for storage of the data, in accordance with input preferences. The data can be split into N secret shares according to a secret sharing method, the selection being determined by the striping policy, wherein a threshold number, T, of such shares is sufficient to recover the data, where T is less than N, generating…

    A method of securely storing data including: providing, within a secure data storage system, a plurality of secret sharing methods for selection and identifying a striping policy for storage of the data, in accordance with input preferences. The data can be split into N secret shares according to a secret sharing method, the selection being determined by the striping policy, wherein a threshold number, T, of such shares is sufficient to recover the data, where T is less than N, generating metadata associated with the data, the metadata identifying the selected secret sharing method and storing the metadata within the secure data storage system and writing the secret shares to storage that includes storage outside the secure data storage system, such that, when at least T shares are retrieved, the metadata can be recalled to identify the selected secret sharing method for recovery of the data.

    Other inventors
    See patent

  • Digital Forensics

    Issued US 8887274

    New digital forensic techniques and systems are disclosed. System call information is collected from a device under test (DUT) and converted to a sequence format. Thereafter, sequence alignment methods and tools can be used to investigate and identify patterns of behavior that are suspicious.

    Other inventors

  • Improved information sharing

    Issued EU WO2014108678 A1

    The present disclosure relates to improved information sharing and in particular to formal representations of information sharing policies between organizations.

    An organization comprises various agents with different roles, which are represented by a form of organizational structure which may for example define a hierarchy of roles. Agents of an organization would normally be individual people although an agent may be a group of people, a software daemon, or a robot for example…

    The present disclosure relates to improved information sharing and in particular to formal representations of information sharing policies between organizations.

    An organization comprises various agents with different roles, which are represented by a form of organizational structure which may for example define a hierarchy of roles. Agents of an organization would normally be individual people although an agent may be a group of people, a software daemon, or a robot for example.

    Organizations hold various items of information for example relating to activities of the organization. For various reasons it is desirable for organizations to collaborate and share information. However, organizations will generally not wish to share the entire corpus of information that they hold with another organization because of concerns regarding confidentiality, commercial sensitivity or other policy considerations such as data protection and human rights. There is a tension between the need for efficient information sharing on the one hand versus respecting these obligations and restrictions on the other.

    Other inventors
    See patent

  • Information sharing

    Issued US US20140201804

    The present disclosure relates to improved information sharing and in particular to formal representations of information sharing policies between organizations.

    An organization comprises various agents with different roles, which are represented by a form of organizational structure which may for example define a hierarchy of roles. Agents of an organization would normally be individual people although an agent may be a group of people, a software daemon, or a robot for…

    The present disclosure relates to improved information sharing and in particular to formal representations of information sharing policies between organizations.

    An organization comprises various agents with different roles, which are represented by a form of organizational structure which may for example define a hierarchy of roles. Agents of an organization would normally be individual people although an agent may be a group of people, a software daemon, or a robot for example.

    Organizations hold various items of information for example relating to activities of the organization. For various reasons it is desirable for organizations to collaborate and share information. However, organizations will generally not wish to share the entire corpus of information that they hold with another organization because of concerns regarding confidentiality, commercial sensitivity or other policy considerations such as data protection and human rights. There is a tension between the need for efficient information sharing on the one hand versus respecting these obligations and restrictions on the other.

    An example of two organizations that have a need for efficient information sharing but in which there are sensitivities regarding the sharing of information would be a police department and a child protection department of a local city council. There is clearly a need in some cases for the police to have information about children under care so that various criminal investigations can be conducted...

    Other inventors
    See patent

  • IMPROVEMENTS IN OR RELATING TO DIGITAL FORENSICS

    Issued US 20120011153

    1. A digital forensic analysis method comprising the steps of: collecting system call data from a digital computing system (DCS); converting the system call data to a sequence format; selecting from a system call sequence database a test sequence of system calls; and performing a sequence matching step to detect matches between the test sequence of system calls and the system call data collected from the DCS.

    2. The method of claim 1, wherein the sequence format represents one system…

    1. A digital forensic analysis method comprising the steps of: collecting system call data from a digital computing system (DCS); converting the system call data to a sequence format; selecting from a system call sequence database a test sequence of system calls; and performing a sequence matching step to detect matches between the test sequence of system calls and the system call data collected from the DCS.

    2. The method of claim 1, wherein the sequence format represents one system call as a sequence element and the sequence is a string of the sequence elements.

    3. The method of claim 2, wherein the sequence elements are alphanumeric characters, preferably letters of the Roman alphabet.

    4. The method of claim 1, wherein the sequence matching step comprises the use of a biological sequence matching algorithm.

    5. The method of claim 4, wherein said biological sequence matching algorithm uses Karlin-Altschul statistics as a basis for determining sequence alignment.

    6. The method of claim 1, further comprising performing a frequency domain analysis of system call data.

    7. The method of claim 6, wherein the frequency domain analysis is carried out before the step of converting the system call data to a sequence format.

    8. The method of claim 6, wherein the frequency domain analysis is carried out after the step of converting the system call data to a sequence format.

    9. The method of claim 6, wherein the frequency domain analysis comprises assigning a value as an amplitude to each system call.






    Other inventors

Projects

  • DFET

    Dynamic Forensics Evaluation and Training (DFET) will create new training methods/techniques to support judicial authorities, law enforcement agencies and associated stakeholders in the fight against cybercrime through the development of a virtual (cloud-based) cybercrime training environment to include real life simulation and scenario analysis. It thus aims to improve crime detection rates by providing scenario-based training in line with the dynamic nature of cybercrime.

    Other creators
    See project

  • Secure IMP Project

    New Innovation Collaboration aims to Secure Remote Working using Patent Pending Technology (IMP)

    A new collaboration between Edinburgh Napier University and Silver IMP aims to apply existing patent pending technology for targeted marketing, into secure working, where documents can only be accessed based on the location of the user.

    The work is funded by a Scottish Funding Council Innovation Voucher, and aims to define a range of use cases within remote working, including within…

    New Innovation Collaboration aims to Secure Remote Working using Patent Pending Technology (IMP)

    A new collaboration between Edinburgh Napier University and Silver IMP aims to apply existing patent pending technology for targeted marketing, into secure working, where documents can only be accessed based on the location of the user.

    The work is funded by a Scottish Funding Council Innovation Voucher, and aims to define a range of use cases within remote working, including within the finance industry, and health and social care.

    Other creators
    See project

  • Guardian Toolkit

    Risk Analysis Platform

    Other creators

  • Trusted Services: Human and Digital Trust

    This project focuses on developing human and digital trust.

    Other creators
    See project

  • DACAR

    -

    EPSRC/TSB Funded Project investigating Cloud Infrastructure for Clinical Data

    Other creators

  • Ontology Matching

    -

    Ontology Matching for the Allatus product.

  • Risk/Fraud Platform

    -

    PhD Funded by FSA

    Other creators
    See project

  • safire

    -

    Information Sharing Governance Architecture

    Other creators
    See project

Recommendations received

3 people have recommended Prof Bill

Join now to view

More activity by Prof Bill

View Prof Bill’s full profile

  • See who you know in common
  • Get introduced
  • Contact Prof Bill directly
Join to view full profile

Other similar profiles

Explore more posts

Explore collaborative articles

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.

Explore More

Add new skills with these courses

See all courses