Technical reports / Department Informatik
Year of publication
- 2014 (5) (remove)
- From Computer Forensics to Forensic Computing: Investigators Investigate, Scientists Associate (2014)
- This paper draws a comparison of fundamental theories in traditional forensic science and the state of the art in current computer forensics, thereby identifying a certain disproportion between the perception of central aspects in common theory and the digital forensics reality. We propose a separation of what is currently demanded of practitioners in digital forensics into a rigorous scientific part on the one hand, and a more general methodology of searching and seizing digital evidence and conducting digital investigations on the other. We thereby mark out the route for computer forensics to turn into a true forensic science. To illustrate the feasibility of the proposed path, we supply a couple of practical examples, as well as a list of exemplary questions that should be answered by digital forensic scientists.
- DiOS: Dynamic Privacy Analysis of iOS Applications (2014)
- We present DiOS, a practical system to perform automated dynamic privacy analysis of iOS apps. DiOS provides a highly scalable and fully automated solution to schedule apps from the official Apple App Store for privacy analysis to iOS devices. While apps are automatically executed, user interaction is simulated using random and smart execution strategies, and sensitive API calls as well as network connections are tracked. We evaluated the system on 1,136 of the most popular free apps from the iOS App Store and found out that almost 20% of all investigated apps are tracking users' locations on every app start, one third of all accesses to users' address books are attributed to apps from the social network category and almost half of all apps are tracking users' app usage behavior by incorporating tracking and advertising libraries.
- Erfolgsmethoden der Open-Source-Governance und -Compliance (2014)
- Open-Source-Software ist weit verbreitet und wird nicht nur als alleinstehende Anwendungen eingesetzt, sondern auch als Komponenten in Produkten. Entsprechend wichtig ist es für Unternehmen, die Open-Source-Komponenten verwenden, mittels Open-Source-Governance und -Compliance sicherzustellen, dass die dem Einsatz von Open Source eigenen Risiken rechtzeitig und korrekt adressiert werden. Aufbauend auf früherer Arbeit zu den Risiken der Open-Source-Verwendung stellt dieser Artikel ein Modell und beispielhafte Erfolgsmethoden („Best Practices“) vor, mit denen Produktunternehmen diesen Risiken begegnen können. Das Modell und die Erfolgsmethoden stellen einen Auszug aus einem in Entwicklung befindlich Handbuch zur Open-Source-Governance und -Compliance dar. Weitere Information zu diesem Handbuch kann vom ersten Autor erfragt werden.
- The Five Stages of Open Source Volunteering (2014)
- Today’s software systems build on open source software. Thus, we need to understand how to successfully create, nurture, and mature the software development communities of these open source projects. In this report, we review and discuss best practices of the open source volunteering and recruitment process that successful project leaders are using to lead their projects to success. We combine the perspective of the volunteer, looking at a project, with the perspective of a project leader, looking to find additional volunteers for the project. We identify a five-stage process consisting of a connecting, understanding, engaging, performing, and leading stage. The underlying best practices, when applied, significantly increase the chances for a successful open source project.
- MATINEE: A Quality-of-Service-aware Event Semantics Modeling Language (2014)
- Distributed event-based systems have risen in significance over the last few years across many different application domains. Still, the configuration of available communication middleware solutions remains an elaborate task driven by technical terms and manual performance optimization. We present the M2etis Quality-of-service-aware Semantics Modeling Language (MATINEE), a domain-specific language for modeling the QoS requirements and semantic properties of event-based systems in the terminology of the application domain. No knowledge of the technical terms of the underlying middleware solution is required by the application developers to conduct the configuration. Embedded in a novel configuration methodology provided by the M2etis project, MATINEE specifications are interpreted to automatically derive optimal middleware configurations without the need for manual optimization. The purpose of MATINEE is to provide a flexible language that can easily be adapted to different application domains. We focus on the language specification of MATINEE, briefly sketch our configuration methodology and present related language approaches.