Technical reports / Department Informatik
- Privacy-Preserving Email Forensics (2015)
- In many digital forensic investigations, email data needs to be analyzed. However, this poses a threat to the privacy of the individual whose emails are being examined and in particular becomes a problem if the investigation clashes with privacy laws. This is commonly addressed by allowing the investigator to run keyword searches and to reveal only those emails that contain at least some of the keywords. While this could be realized with standard cryptographic techniques, further requirements are present that call for novel solutions: (i) for investigation-tactical reasons the investigator should be able to keep the search terms secret and (ii) for efficiency reasons no regular interaction should be required between the investigator and the data owner. We close this gap by introducing a novel cryptographic scheme that allows to encrypt entire email boxes before handing them over for investigation. The key feature is that the investigator can non-interactively run keyword searches on the encrypted data and decrypt those emails (and only those) for which a configurable number of matches occurred. Our implementation as a plug-in for a standard forensic framework confirms the practical applicability of the approach.
- Inner Source in Platform-Based Product Engineering (2015)
- Inner source is an approach to collaboration across intra-organizational boundaries for the creation of shared reusable assets. Prior project reports on inner source suggest improved code reuse and better knowledge sharing. Using a multiple-case case study research approach, we analyze the problems that three major software development organizations were facing in their platform-based product engineering efforts. We find that a root cause, the separation of product units as profit centers from a platform organization as a cost center, leads to delayed deliveries, increased defect rates, and redundant software components. All three organizations assume that inner source can help solve these problems. The article analyzes the expectations that these companies were having towards inner source and the problems they were experiencing or expecting in its adoption. Finally, the article presents our conclusions on how these organizations should adapt their existing engineering efforts.
- An Experiment in Wait-Free Synchronisation of Priority-Controlled Simultaneous Processes: Guarded Sections (2015)
- Wait-free synchronisation gives any process in the system strong progress guarantees, irrespective of number and behaviour of other processes simultaneously competing for shared resources (i.e., data structures and code sections). It ensures completion of any operation in a finite number of steps and, thus, provides the basis to derive bounded above or even constant executions times for non-sequential programs. This characteristic is of special meaning for time-dependent processes typical for real-time (embedded) systems. But wait-free synchronisation against the background of especially arbitrary data and code structures is no bed of roses. This paper is about organising non-sequential programs to the benefit of wait-free synchronisation. Conventional critical sections are designed as so called guarded sections. Unlike critical sections, preferential processes never block at entrance to a guarded section though only one process at a time is allowed to pass through. Competing processes are forced into bypass but, if necessary and by using futures, they can synchronise on concurrent state changes inside the respective section. In consequence of this measure, the execution model of guarded sections constrains the overlapping pattern of interacting (simultaneous) processes. Thereby, efficient wait-free synchronisation of the "guarding operations" is a gratifying by-product. First experiments on a 80-way multi-core system show that non-blocking wait-free synchronised guarded sections outperform lock-based protection schemes such as MCS-locks.
- From Computer Forensics to Forensic Computing: Investigators Investigate, Scientists Associate (2014)
- This paper draws a comparison of fundamental theories in traditional forensic science and the state of the art in current computer forensics, thereby identifying a certain disproportion between the perception of central aspects in common theory and the digital forensics reality. We propose a separation of what is currently demanded of practitioners in digital forensics into a rigorous scientific part on the one hand, and a more general methodology of searching and seizing digital evidence and conducting digital investigations on the other. We thereby mark out the route for computer forensics to turn into a true forensic science. To illustrate the feasibility of the proposed path, we supply a couple of practical examples, as well as a list of exemplary questions that should be answered by digital forensic scientists.
- DiOS: Dynamic Privacy Analysis of iOS Applications (2014)
- We present DiOS, a practical system to perform automated dynamic privacy analysis of iOS apps. DiOS provides a highly scalable and fully automated solution to schedule apps from the official Apple App Store for privacy analysis to iOS devices. While apps are automatically executed, user interaction is simulated using random and smart execution strategies, and sensitive API calls as well as network connections are tracked. We evaluated the system on 1,136 of the most popular free apps from the iOS App Store and found out that almost 20% of all investigated apps are tracking users' locations on every app start, one third of all accesses to users' address books are attributed to apps from the social network category and almost half of all apps are tracking users' app usage behavior by incorporating tracking and advertising libraries.
- Erfolgsmethoden der Open-Source-Governance und -Compliance (2014)
- Open-Source-Software ist weit verbreitet und wird nicht nur als alleinstehende Anwendungen eingesetzt, sondern auch als Komponenten in Produkten. Entsprechend wichtig ist es für Unternehmen, die Open-Source-Komponenten verwenden, mittels Open-Source-Governance und -Compliance sicherzustellen, dass die dem Einsatz von Open Source eigenen Risiken rechtzeitig und korrekt adressiert werden. Aufbauend auf früherer Arbeit zu den Risiken der Open-Source-Verwendung stellt dieser Artikel ein Modell und beispielhafte Erfolgsmethoden („Best Practices“) vor, mit denen Produktunternehmen diesen Risiken begegnen können. Das Modell und die Erfolgsmethoden stellen einen Auszug aus einem in Entwicklung befindlich Handbuch zur Open-Source-Governance und -Compliance dar. Weitere Information zu diesem Handbuch kann vom ersten Autor erfragt werden.
- The Five Stages of Open Source Volunteering (2014)
- Today’s software systems build on open source software. Thus, we need to understand how to successfully create, nurture, and mature the software development communities of these open source projects. In this report, we review and discuss best practices of the open source volunteering and recruitment process that successful project leaders are using to lead their projects to success. We combine the perspective of the volunteer, looking at a project, with the perspective of a project leader, looking to find additional volunteers for the project. We identify a five-stage process consisting of a connecting, understanding, engaging, performing, and leading stage. The underlying best practices, when applied, significantly increase the chances for a successful open source project.
- MATINEE: A Quality-of-Service-aware Event Semantics Modeling Language (2014)
- Distributed event-based systems have risen in significance over the last few years across many different application domains. Still, the configuration of available communication middleware solutions remains an elaborate task driven by technical terms and manual performance optimization. We present the M2etis Quality-of-service-aware Semantics Modeling Language (MATINEE), a domain-specific language for modeling the QoS requirements and semantic properties of event-based systems in the terminology of the application domain. No knowledge of the technical terms of the underlying middleware solution is required by the application developers to conduct the configuration. Embedded in a novel configuration methodology provided by the M2etis project, MATINEE specifications are interpreted to automatically derive optimal middleware configurations without the need for manual optimization. The purpose of MATINEE is to provide a flexible language that can easily be adapted to different application domains. We focus on the language specification of MATINEE, briefly sketch our configuration methodology and present related language approaches.
- A Framework for Interactive Physical Simulations on Remote HPC Clusters (2013)
- In this work, we introduce the framework for visualization and interactivity for physics engines in real-time, for short VIPER. It is able to execute various physical simulations, visualize the simulation results in real-time and offer computational steering. Especially interesting in this context are simulations running on remotely accessible HPC clusters. As an example, we present a particulate flow simulation consisting of a coupled rigid body and CFD simulation, the chosen visualization strategy and steering possibilities. Additionally, performance evaluations and a performance prediction model concerning the update rate for remote simulations in the context of the VIPER framework are given.
- A Cost Constrained Boosting Algorithm for Fast Object Detection (2013)
- Boosting methods are among the most widely used machine learning techniques in practice for various reasons. In many scenarios, however, their use is prevented by runtime constraints. In this paper we propose a novel technique for reducing the computational complexity of hierarchical classifiers based on AdaBoost, such as the probabilistic boosting tree, which are often used for object detection. We modify AdaBoost training so that the hypothesis generation is no longer based solely on the weak learner’s training error but also on a measure of hypothesis complexity. This is achieved by incorporating a cost function into the optimization process, effectively constraining feature selection, which leads to a reduced overall classifier complexity and thus shorter evaluation times. The validity of the approach is shown in an experimental valuation on real-world data. In a cross validation experiment with a system for automatic segmentation of liver tumors in CT images, the evaluation cost for classifying previously unseen samples could be reduced by up to 76% using the methods described here without losing classification accuracy.