One-class classification is a specialized form of classification from the field of machine learning. Traditional classification attempts to assign unknowns to known classes, but cannot handle novel unknowns that do not belong to any of the known classes. One-class classification seeks to identify these outliers, while still correctly assigning unknowns to classes appropriately. One-class classification is applied here to the field of nuclear forensics, which is the study and analysis of nuclear material for the purpose of nuclear incident investigations. Nuclear forensics data poses an interesting challenge because false positive identification can prove costly and data is often small, high-dimensional, and sparse, which is problematic for most machine learning approaches. A web application is built using the R programming language and the shiny framework that incorporates N-SLOPE: a machine learning ensemble. N-SLOPE combines five existing one-class classifiers with a novel one-class classifier introduced here and uses ensemble learning techniques to combine output. N-SLOPE is validated on three distinct data sets: Iris, Obsidian, and Galaxy Serpent 3, which is an enhanced version of a recent international nuclear forensics exercise. N-SLOPE achieves high classification accuracy on each data set of 100%, 83.33%, and 83.33%, respectively, while minimizing false positive detection rate to 0% across the board and correctly detecting every single novel unknown from each data set. N-SLOPE is shown to be a useful and powerful tool to aid in nuclear forensic investigations.

No description available.

Drug trafficking and smuggling is an ongoing challenge for law enforcement agencies. Cocaine smuggling is a high-value pursuit for smugglers and has been attempted using a variety of concealment methods including the use of bottled liquids, canned milk, wax and suspensions in cans of beer. In particular, traffickers have used clothing impregnated with cocaine for smuggling. Handling, transportation or re-packaging of drugs of abuse and explosives will inevitably leave residual material on the clothing and other possessions of the involved persons. The nails and skin of the person may also be contaminated through the handling of these substances. This research study describes the development of Raman spectroscopic techniques for the detection of drugs of abuse and explosives on biomaterials of forensic relevance including undyed natural and synthetic fibres and dyed textile specimens, nail and skin. Confocal Raman microscopy has been developed and evaluated for the detection and identification of particulates of several drugs of abuse and explosives on different substrates. The results show that excellent spectroscopic discrimination can be achieved between single particles and substrate materials, giving a ubiquitous non-destructive approach to the analysis of pico-gram quantities of the drugs and explosives in-situ. Isolating the particle in this way corresponds with an analytical sensitivity comparable with the most sensitive analytical techniques currently available e.g. the highly sensitive, yet destructive ionization desorption mass spectrometry. With the confocal Raman approach, this work demonstrates that definitive molecular-specific information can be achieved within seconds without significant interference from the substrate. The potential for the application of this technique as a rapid preliminary, forensic screening procedure is obvious and attractive to non-specialist operators as it does not involve prior chemical pretreatment ii or detachment of the analyte from the substrate. As a result, evidential materials can be analysed without compromising their integrity for future investigation. Also, the applications of benchtop and portable Raman spectroscopy for the in-situ detection of drugs of abuse in clothing impregnated with the drugs have been demonstrated. Raman spectra were obtained from a set of undyed natural and synthetic fibres and dyed textiles impregnated with these drugs. The spectra were collected using three Raman spectrometers; one benchtop dispersive spectrometer coupled to a fibre-optic probe and two portable spectrometers. High quality spectra of the drugs could be acquired in-situ within seconds and without any sample preparation or alteration of the evidential material. A field-portable Raman spectrometer is a reliable instrument that can be used by emergency response teams to rapidly identify unknown samples. This method lends itself well to further development for the in-situ examination by law enforcement officers of items associated with users, handlers and suppliers of drugs of abuse in the forensics arena. In the last section of this study, a portable prototype Raman spectrometer ( DeltaNu Advantage 1064) equipped with 1064 nm laser excitation has been evaluated for the analysis of drugs of abuse and explosives. The feasibility of the instrument for the analysis of the samples both as neat materials and whilst contained in plastic and glass containers has been investigated. The advantages, disadvantages and the analytical potential in the forensics arena of this instrument have been discussed. / Egyptian Government and Sohag University

Biometrics is a unique physical or behavioral characteristic of a person. This unique attribute, such as fingerprints or gait, can be used for identification or verification purposes. Gait is an emerging biometrics with great potential. Gait recognition is based on recognizing a person by the manner in which they walk. Its potential lays in that it can be captured at a distance and does not require the cooperation of the subject. This advantage makes it a very attractive tool for forensic cases and applications, where it can assist in identifying a suspect when other evidence such as DNA, fingerprints, or a face were not attainable. Gait can be used for recognition in a direct manner when the two samples are shot from similar camera resolution, position, and conditions. Yet in some cases, the only sample available is of an incomplete gait cycle, low resolution, low frame rate, a partially visible subject, or a single static image. Most of these conditions have one thing in common: static measurements. A gait signature is usually formed from a number of dynamic and static features. Static features are physical measurements of height, length, or build; while dynamic features are representations of joint rotations or trajectories. The aim of this thesis is to study the potential of predicting dynamic features from static features. In this thesis, we have created a database that utilizes a 3D laser scanner for capturing accurate shape and volumes of a person, and a motion capture system to accurately record motion data. The first analysis focused on analyzing the correlation between twenty-one 2D static features and eight dynamic features. Eleven pairs of features were regarded as significant with the criterion of a P-value less than 0.05. Other features also showed a strong correlation that indicated the potential of their predictive power. The second analysis focused on 3D static and dynamic features. Through the correlation analysis, 1196 pairs of features were found to be significantly correlated. Based on these results, a linear regression analysis was used to predict a dynamic gait signature. The predictors chosen were based on two adaptive methods that were developed in this thesis: "the top-x" method and the "mixed method". The predictions were assessed for both for their accuracy and their classification potential that would be used for gait recognition. The top results produced a 59.21% mean matching percentile. This result will act as baseline for future research in predicting a dynamic gait signature from static features. The results of this thesis bare potential for applications in biomechanics, biometrics, forensics, and 3D animation.

A key emerging concept within the forensic sciences today areportable measurementdevices, where a much more efficient usage of the resources involved with crime-solving is possible if confirmatory measurements can be realised directly at a crimescene with such devices. Today, the majority of the presently used methods duringcriminal investigation at a crime scene involves measurements of a presumptivenature, which is a vital tool as it enables the screening of samples. In this thesis,the overarching goal is the development of tool kits for the analysis of biosampleson-site at a crime scene. This is mainly investigated through two routes: theusage of Quantum Dots (QDs) as a recognition element in sensory applications andfabrication of a graphene-based device for the detection of illicit drugs.The investigations conducted for the studies presented in this thesis focuses onsensory applications with a forensic detection scheme in mind: study I reveals in-trinsic properties of QDs to better understand sensing mechanisms upon bindinginteractions; study II demonstrates the fabrication of a graphene-based device forthe detection of illicit drugs; study III showcases the functionalised and bioconju-gated of QDs for a specific investigation into a biological process; study IV furtherthe investigation into the possible side-effects of QDs on biological specimens.In study I we numerically and experimentally investigate the intrinsic blinkingcharacteristics of CdSe-CdS/ZnS QDs. This includes a thorough examination of theexperimental parameters of the measurement setup: the bin time and excitationpower. Different mechanisms between the off- and on-state probability distributionsare found, wherein the on-state follows the random telegraph signal theory and theoff-state follows the inverse power law distribution.In study II, the detection of illicit drugs (amphetamine and cocaine) is achievedthrough graphene-based sensors processed to contain metal electrodes with superioradhesion and low contact resistance. The construction of a microfluidic system isfurther realised for a detection of molecules based on non-covalent interactions.With this system, a wavelength-dependent photoactivity for amphetamine and arange of its chemical analogs is demonstrated. A molecule dependent interactionwith the graphene surface is shown of the graphene surface either in the form ofp-doping (cocaine) or n-doping (amphetamine).Study III investigates the endocytic pathway of the vascular cell adhesionmolecule 1 (VCAM1) in Human Umbilical Vein Endothelial Cells (HUVECs) in-iiiivABSTRACTduced by Tumor Necrosis Factorα(TNFα) with the usage of 3-Mercaptopropionicacid coated (3MPA)-QDs and 5-Carboxyfluorescein (5FAM) functionalised and la-belled with VCAM1 binding peptides, respectively. Internalisation of the VCAM1molecules into lysosomes is shown with light microscopy through observations ofdifferent pathways of the 5FAM labelled peptides and functionalised QDs.In study IV we investigate the adverse effects of 3MPA-QDs on the humanairway epithelium by an examination of the calcium response in lung cells upon astimulation with QDs. The cellular response to the deposition of QDs is observedwith light microscopy and electrical measurements as a global increase of Ca2+in the epithelial layers and a transient decrease in the electrical response. Theseobservations imply that the influx of calcium caused by the QD deposition is inducedby mechanical stressIn an additional ongoing study, the age determination of dried blood spotsare investigated with the usage of protein markers commonly found in the blood.Human serum (HS) is spiked with a marker of interest to mimic those of normallevels in adult human males. After which the HS is allowed to undergo an ageingprocess in a 96 well plate and further analysed in terms of the enzymatic activitywith commercially available kits. The preliminary test results show that there is ameasurable change of activity dependenton the utilised marker that may act as abasis for the age determination of dried blod spots / <p>Examinator: Professor Björn Önfelt</p>

It is not uncommon for criminals to start a fire at a crime scene to conceal evidence of the initial crime. The rationale for this can be attributed to the belief that a fire will destroy all physical evidence. It has been shown in previous research that physical evidence in the form of ignitable liquid residues, fingerprints and even DNA (deoxyribonucleic acid) evidence can still be recovered from the scene of a fire. However, testing of fire debris evidence for multiple forms of evidence has no universally accepted protocol or order of testing. The purpose of this study is two-fold. DNA recovered from simulated fire debris evidence exposed to various ignitable liquids and burn conditions was compared to determine under what scene conditions it could be feasible to recover DNA evidence and generate usable profiles. Additionally, DNA recovered from samples subjected to different time and temperature conditions of heated passive headspace concentration (HPHC) were compared to determine if it was advisable to perform HPHC in an attempt to recover volatile ignitable liquid evidence prior to testing for DNA. The HPHC overall had no significant effect on the degradation or recovered quantities of DNA, and, under the conditions tested, this would not preclude testing for ignitable liquids prior to testing for DNA. The presence of ignitable liquids did not affect the ability to recover DNA or result in degraded DNA, while burning samples prevented DNA from being recovered in all but a few samples, primarily semen samples.

In Belgium, approximately 75 homicides a year go unnoticed. In addition it is estimated that 5 - 10% of the so-called natural deaths are not natural at all. This amounts to 5,000 – 10,000 deaths a year with an incorrect cause of death. Both Belgium – composed of three regions, three communities, and ten provinces – and the United States of America – divided into 50 states – are overseen by a Federal Government, and their police system consist of multiple law enforcement agencies. When looking from a distance, more similarities than differences are seen for the organization of law enforcement agencies. However, differences become apparent when analyzing the responsibilities of the different agencies during crime scene processing and evidence collection. Seen the scope of the forensic science program, the focus will more specifically be on the process, procedures, and actors involved. The goal of this thesis is to (a) analyze the Belgian and U.S. crime scene investigation system, (b) compare the two systems to one another, (c) discuss the weaknesses and strengths behind each system, and finally (d) come up with recommendations. Existing issues will also be evaluated and their impact will be discussed. To achieve the above mentioned goals, information was obtained through literature review and interviews with experts. During the interviews information (e.g. books), not available to the general public, was obtained. Crime scene investigation, for both the U.S. and Belgian system, can be divided into 5 different steps: the initial notification, the first response team, the investigation of the crime scene (documenting, collecting, and processing evidence), the analysis of collected evidence, and the autopsy. In both systems, first responders and emergency medical services will be the first actors present at the scene. Although most procedures and actors involved in the investigation of a crime scene are similar between the United States of America and Belgium, some differences cannot be overlooked. These differences are: the person in charge of completing the death certificate, determining whether or not jurisdiction is accepted, the educational background and composition of the crime scene team, the investigation of the deceased, the requirements needed to become a forensic pathologist, and the cases in which an autopsy is systematically performed. Comparing both crime scene investigation systems showed that each system has its own strengths, weaknesses, and issues. The comparison also showed that both systems can learn from one another, since the combination of already existing processes and procedures, from both crime scene investigation systems, was used to create an “ideal” crime scene investigation system.

Fatal accidents on the road are an unfortunate daily occurrence, with almost 30,000 deaths resulting from hit-and-runs in the USA between 2006 and 2021. The identification of the driver responsible for this road crime can become a challenge. Nonetheless, the accident scene provides a large amount of trace evidence that can prove critical to this matter, one of them being the tire marks. While traditional tire mark analysis is full of physical information helping the reconstruction of the event, additional information can be extracted from the rubber left during the braking event. Each tire model is manufactured with a specific design, obtained by a chemical formulation that can become its signature. Supplemental to the molecular profile of the rubber itself, analysis of the trace and contaminant elements can help build the chemical signature for the tire rubber. This work consists of establishing the link between the tire and the skid mark and particles it left during a braking event. The difference between tire models was proved from the elemental analysis of the tire rubber itself, showing that the specific content of minor and trace elements is specific to the model. Expanding to the problem of tire marks, the first challenge consists in efficiently sampling the rubber from the road. The development of an effective procedure to lift the tire particles from the mark is demonstrated in this work. This does present some challenges, including removal of other particles present within the lift and extraction of the tire rubber for further analysis by ICP-MS, providing an elemental profile for the sampled skid mark. Finally, with the skid mark rubber analyzed, it is compared with the elemental profile of the rubber from the source tire. The results of this comparison will be discussed in both simulated (with a lab- made tire mark maker) and field cases (from braking tests performed by the Florida Highway Patrol (FHP)). The results of my research provide the forensic community with the first evaluation of elemental analysis of tire rubber to use this seldom used trace evidence, all along the analytical process, from sampling to analysis to attribution.

<p dir="ltr">The rapid development of machine learning techniques makes it possible to manipulate or synthesize video and audio information while introducing nearly indetectable artifacts. Most media forensics methods analyze the high-level data (e.g., pixels from videos, temporal signals from audios) decoded from compressed media data. Since media manipulation or synthesis methods usually aim to improve the quality of such high-level data directly, acquiring forensic evidence from these data has become increasingly challenging. In this work, we focus on media forensics techniques using the metadata in media formats, which includes container metadata and coding parameters in the encoded bitstream. Since many media manipulation and synthesis methods do not attempt to hide metadata traces, it is possible to use them for forensics tasks. First, we present a video forensics technique using metadata embedded in MP4/MOV video containers. Our proposed method achieved high performance in video manipulation detection, source device attribution, social media attribution, and manipulation tool identification on publicly available datasets. Second, we present a transformer neural network based MP3 audio forensics technique using low-level codec information. Our proposed method can localize multiple compressed segments in MP3 files. The localization accuracy of our proposed method is higher compared to other methods. Third, we present an H.264-based video device matching method. This method can determine if the two video sequences are captured by the same device even if the method has never encountered the device. Our proposed method achieved good performance in a three-fold cross validation scheme on a publicly available video forensics dataset containing 35 devices. Fourth, we present a Graph Neural Network (GNN) based approach for the analysis of MP4/MOV metadata trees. The proposed method is trained using Self-Supervised Learning (SSL), which increased the robustness of the proposed method and makes it capable of handling missing/unseen data. Fifth, we present an efficient approach to compute the spectrogram feature with MP3 compressed audio signals. The proposed approach decreases the complexity of speech feature computation by ~77.6% and saves ~37.87% of MP3 decoding time. The resulting spectrogram features lead to higher synthetic speech detection performance.</p>

Peer-to-Peer (P2P) Networks have been presenting many fascinating capabilities to the internet since their inception, which has made and is still gathering so much interest. As a result, it is being used in many domains, particularly in transferring a large amount of data, which is essential for modern computing needs. A P2P network contains many independent nodes to form a highly distributed system. These nodes are used to exchange all kinds of files without using a single server as in a Client-Server architecture. Such types of files make the network highly vulnerable to malicious attackers. Nevertheless, P2P systems have become susceptible to different malicious attacks due to their widespread usage, including the threat of sharing malware and other dangerous programs, which can be significantly damaging and harmful. A significant obstacle with the current P2P network traffic monitoring and analysis involves many newly emerging P2P architectures possessing more intricate communication structures and traffic patterns than the traditional client-server architectures. The traffic volume generated by these networks, such as uTorrent, Gnutella, Ares, etc., was once well over half of the total internet traffic. The dynamic use of port numbers, multiple sessions, and other smart features of these applications complicate the characterization of current P2P traffic. Transport-level traffic identification is a preliminary but required step towards traffic characterization, which this thesis addresses. Therefore, a novel detection mechanism that relies on transport-level traffic characterization has been presented for P2P network investigation The importance of the investigation necessitates the formalization of frameworks to leverage the integration of forensics standards and accuracy to provide integrity to P2P networks. We employed the standard Analysis, Design, Development, Implementation, and Evaluation (ADDIE) model to aid a credible digital investigation. We considered the ADDIE model for validation as a standard digital forensic model for P2P network investigations using the United States’ Daubert Standard, the United Kingdom's Forensic Science Regulator Guidance – 218 (FSR-G-218), and Forensic Science Regulator Guidance – 201 (FSR-G-201) methodologies. The solution was evaluated using a realistic P2P investigation and showed accurate load distribution and reliable digital evidence. / Petroleum Technology Development Fund (PTDF) Nigeria