Common office documents provide significant opportunity for forensic and anti-forensic work. The Object Linking and Embedding 2 (OLE2) specification used primarily by Microsoft’s Office Suite contains unused or dead space regions that can be over written to hide covert channels of communication. This thesis describes a technique to detect those covert channels and also describes a different method of encoding that lowers the probability of detection. The algorithm developed, called OleDetection, is based on the use of kurtosis and byte frequency distribution statistics to accurately identify OLE2 documents with covert channels. OleDetection is able to correctly identify 99.97 percent of documents with covert channel and only a false positive rate 0.65 percent. The improved encoding scheme encodes the covert channel with patterns found in unmodified dead space regions. This anti-forensic technique allows the covert channel to masquerade as normal data, lowering the ability probability for any detection tool to is able to detect its presence.

Covert communication refers to the process of communicating data through a channel that is neither designed, nor intended to transfer information. Traditionally, covert channels are considered as security threats in computer systems and a great deal of attention has been given to countermeasures for covert communication schemes. The evolution of computer networks led the communication community to revisit the concept of covert communication not only as a security threat but also as an alternative way of providing security and privacy to communication networks. In fact, the heterogeneous structure of computer networks and the diversity of communication protocols provide an appealing setting for covert channels. This dissertation is an exploration on a novel design methodology for undetectable and robust covert channels in communication networks. Our new design methodology is based on the concept of behavioral mimicry in computer systems. The objective is to design a covert transmitter that has enough degrees of freedom to behave like an ordinary transmitter and react normally to unpredictable network events, yet it has the ability to modulate a covert message over its behavioral fingerprints in the network. To this end, we argue that the inherent randomness in communication protocols and network environments is the key in finding the proper medium for network covert channels. We present a few examples on how random behaviors in communication protocols lead to discovery of suitable shared resources for covert channels. The proposed design methodology is tested on two new covert communication schemes, one is designed for wireless networks and the other one is optimized for public communication networks (e.g., Internet). Each design is accompanied by a comprehensive analysis from undetectability, achievable covert rate and reliability perspectives. In particular, we introduced turbo covert channels, a family of extremely robust model-based timing covert channels that achieve provable polynomial undetectability in public communication networks. This means that the covert channel is undetectable against any polynomial-time statistical test that analyzes samples of the covert traffic and the legitimate traffic of the network. Target applications for the proposed covert communication schemes are discussed including detailed practical scenarios in which the proposed channels can be implemented.

Thesis (Honors)--College of William and Mary, 2009. / Includes bibliographical references (leaves 35-37). Also available via the World Wide Web.

Η προστασία των πνευματικών δικαιωμάτων και η απόδειξη γνησιότητας του κατόχου, επομένως και η πιστοποίηση της αυθεντικότητας των ψηφιακών αντικειμένων είναι ένα πολύ καυτό ζήτημα και για την επίλυσή του επιστρατεύονται μέθοδοι απόκρυψης πληροφορίας και τεχνικές υδατογράφησης. Εκτός από τη φιλοσοφική αντιμετώπιση του θέματος, προτείνονται μια μέθοδος απόκρυψης πληροφορίας και δύο τεχνικές υδατογράφησης, με σκοπό την προστασία των πνευματικών δικαιωμάτων και την πιστοποίηση της αυθεντικότητας των ψηφιακών αντικειμένων. Η μέθοδος απόκρυψης πληροφορίας δανείζεται έννοιες από την κρυπτογραφία εισάγοντας σε μεγάλες εικόνες ένα δύσκολο στιγμιότυπο, δηλαδή έναν τρία χρωματίσιμο γράφο. Ο γράφος μαζί με το χρωματισμό του αποτελεί το κλειδί. Για να μην αποκαλυφθεί όλος ο χρωματισμός του γράφου σε μια πιθανή διαμάχη, εφαρμόζεται το πρωτόκολλο των διαντιδραστικών αποδείξεων μηδενικής γνώσης (ZKIP) για δύσκολα υπολογιστικά προβλήματα. Η διαδικασία της ένθεσης γίνεται με χρήση του μετασχηματισμού wavelets, παρέχοντας καλή ποιότητα των παραγόμενων εικόνων και ανθεκτικότητα σε περιπτώσεις επιθέσεων. Οι δύο τεχνικές υδατογράφησης εφαρμόζονται στο χωρικό πεδίο και στο πεδίο συχνοτήτων, αντίστοιχα. Η τεχνική που εφαρμόστηκε στο χωρικό πεδίο εκμεταλλεύεται τυχόν ομοιότητες του υδατογραφήματος με τις αρχικές εικόνες για να επιλεγούν οι θέσεις ένθεσης. Αντίθετα στην τεχνική υδατογράφησης που εφαρμόστηκε στο πεδίο συχνοτήτων γίνεται χρήση του μετασχηματισμού wavelet. Σε όλες τις τεχνικές παρατηρήθηκαν ικανοποιητικά αποτελέσματα μετά την ένθεση της εισαγόμενης πληροφορίας έτσι ώστε να μη είναι οπτικά αντιληπτή. Επίσης εξετάστηκε και η ανθεκτικότητα της εισαγόμενης πληροφορίας στις εικόνες ύστερα από πιθανές επιθέσεις και επιβεβαιώθηκε ότι επιζεί ένα αρκετά μεγάλο ποσοστό της εισαγόμενης πληροφορίας, γεγονός που καταξιώνει τις προτεινόμενες μεθόδους. / The copyright protection and the authentication is a very hot topic and for its solution are called up data hiding methods and watermarking techniques. Αpart from the philosophical confrontation of the subject, there are proposed a data hiding method and two watermarking techniques that aim to copyright protect and the authenticate digital objects. The data hiding technique combines concepts from cryptography and it can be applied to large images by inserting a hard instance, i.e. a 3-colorable graph. The graph itself with its coloring compose the key. In order not to reveal all its coloring in a possible conflict, the Zero Knowledge Interactive Proof Protocol (ZKIP) is applied. The insertion process has been done using wavelets transformation, offering good quality of the produced images and robustness against possible attacks. The two watermarking techniques are applied in spatial domain and in frequency domain, respectively. The technique that was applied in spatial domain is exploiting any similarity between the watermark and the initial images so that to select at best the insertion positions. On the contrary, in the watermarking technique that is applied in the frequency domain, wavelets transformation has been used and the watermark was inserted in the differential coefficients of the image, in order to be imperceptible. To all the above techniques, it has been observed sufficient results after the insertion of the redundant information, so that it turned to be visible imperceptibly. Moreover, the robustness of the redundant information was each time after possible attacks examined, and it was confirmed that a rather big percentage of the redundant information is survived, making more reliable the proposed techniques.

Covert communication refers to the process of communicating data through a channel that is neither designed, nor intended to transfer information. Traditionally, covert channels are considered as security threats in computer systems and a great deal of attention has been given to countermeasures for covert communication schemes. The evolution of computer networks led the communication community to revisit the concept of covert communication not only as a security threat but also as an alternative way of providing security and privacy to communication networks. In fact, the heterogeneous structure of computer networks and the diversity of communication protocols provide an appealing setting for covert channels. This dissertation is an exploration on a novel design methodology for undetectable and robust covert channels in communication networks. Our new design methodology is based on the concept of behavioral mimicry in computer systems. The objective is to design a covert transmitter that has enough degrees of freedom to behave like an ordinary transmitter and react normally to unpredictable network events, yet it has the ability to modulate a covert message over its behavioral fingerprints in the network. To this end, we argue that the inherent randomness in communication protocols and network environments is the key in finding the proper medium for network covert channels. We present a few examples on how random behaviors in communication protocols lead to discovery of suitable shared resources for covert channels. The proposed design methodology is tested on two new covert communication schemes, one is designed for wireless networks and the other one is optimized for public communication networks (e.g., Internet). Each design is accompanied by a comprehensive analysis from undetectability, achievable covert rate and reliability perspectives. In particular, we introduced turbo covert channels, a family of extremely robust model-based timing covert channels that achieve provable polynomial undetectability in public communication networks. This means that the covert channel is undetectable against any polynomial-time statistical test that analyzes samples of the covert traffic and the legitimate traffic of the network. Target applications for the proposed covert communication schemes are discussed including detailed practical scenarios in which the proposed channels can be implemented.

Video transmission over noisy wireless channels leads to errors on video, which degrades the visual quality notably and makes error concealment an indispensable job. In the literature, there are several error concealment techniques based on estimating the lost parts of the video from the available data. Utilization of data hiding for this problem, which seems to be an alternative of predicting the lost data, provides a reserve information about the video to the receiver while unchanging the transmitted bit-stream syntax / hence, improves the reconstruction video quality without significant extra channel utilization. A complete error resilient video transmission codec is proposed, utilizing imperceptible embedded information for combined detecting, resynchronization and reconstruction of the errors and lost data. The data, which is imperceptibly embedded into the video itself at the encoder, is extracted from the video at the decoder side to be utilized in error concealment. A spatial domain error recovery technique, which hides edge orientation information of a block, and a resynchronization technique, which embeds bit length of a block into other blocks are combined, as well as some parity information about the hidden data, to conceal channel errors on intra-coded frames of a video sequence. The errors on inter-coded frames are basically recovered by hiding motion vector information along with a checksum into the next frames. The simulation results show that the proposed approach performs superior to conventional approaches for concealing the errors in binary symmetric channels, especially for higher bit rates and error rates.

Thesis (M.S.)--Humboldt State University, 2009. / Includes bibliographical references (leaves 89-96). Also available via Humboldt Digital Scholar.

This thesis studies knowledge processes which span organisational boundaries, examining how knowledge is formed and shared between two companies with divergent interests, facing the challenges of innovation processes. Cross-boundary work provides access to diverse sources of knowledge, specialties and approaches, and this enhances the innovative performance of firms. However, managing knowledge and spanning diverse boundaries has proven to be difficult. While the epistemic and social challenges have been identified to trigger conflicts and misunderstandings across boundaries, the complexity, inter-dependency and uncertainty of innovation processes have been found to multiply these challenges. Informed by the practice-based perspective, this thesis examines how the challenges of integrating knowledge in such a context are addressed and resolved. Building upon this theoretical perspective, the thesis aims to enhance understandings of knowledge processes between the large bureaucratic organisations (publishers) and small/medium-sized companies (developers) in the videogames industry. Underpinned by a social constructionist and interpretivist methodology, a qualitative study of three publisher-developer relationships was conducted. With thirty six semi-structured interviews with senior directors, managers and team leaders, the thesis examined cross- boundary practices and the conflicts experienced in this process. In order to achieve this, the study focused on the role that boundary objects, trust development and power structures played in facilitating knowledge processes. The thesis recognises the evolving and relational character of boundary objects, highlighting that a combination of static and dynamic boundary objects were effective in facilitating knowledge integration in the publisher-developer relationship. It also reveals that despite high levels of distrust between the parties involved, they managed to create and maintain a working relationship by resorting to opportunistic practices, such as knowledge hiding, deception and collusion. It is emphasised that understanding the power dynamics in the publisher-developer relationship is a pre-requisite to explaining 2 how knowledge is managed across organisational boundaries during the course of a project. Drawing upon a Foucauldian perspective, the thesis identifies the positive and enabling aspects of power dynamics in this relationship. It argues that when the parties have discrepancies, competition and high levels of distrust, power games positively influence cross-boundary practices, the use of boundary objects and knowledge processes, ultimately mobilising knowledge integration. The thesis makes four significant contributions to the knowledge management and cross-boundary work literature. First, it identifies an evolving role for boundary objects, showing how they develop during the course of a project. Second, it finds a relational and politicised dimension for boundary objects, highlighting the role of brokers to manipulate and mobilise the use and effectiveness of these objects. Third, the thesis extends the existing literature by revealing that despite high levels of distrust, parties can create a working relationship. The research shows that this is achieved through resorting to opportunistic behaviour, such as knowledge hiding, deception and collusion. As a result, this thesis adds a complementary level to Carlile's Integrated Framework, explaining that when there are high levels of differences, dependencies and novelty in the cross-boundary work, knowledge hiding, deception and collusion are the driving force to facilitate knowledge integration and maintain a functional relationship. The fourth contribution of this thesis is recognising the positive and productive aspects of power dynamics that enable and mobilise boundary objects and knowledge processes, ultimately bringing positive outcomes and creating a functional relationship between two companies with divergent interests.

For a long time, information hiding has focused on carriers like images and audio files. A problem with these carriers is that they do not support hiding in new types of network-based services. Nowadays, these services often arise as a consequence of the increasingly demand for higher connection speed to the Internet. By introducing streaming media as a carrier of hidden information, hiding in new network-based services is supported. The main purposes with this thesis are to investigate how information can be hidden in streaming media and how it measures up compared to images and audio files. In order to evaluate the approach, we have developed a prototype and used it as a proof of concept. This prototype hides information in some of the TCP/IP header fields and is used to collect experimental data as well. As reference, measurements have been collected from other available carriers of hidden information. In some cases, the results of these experiments show that the TCP/IP header is a good carrier of information. Its performance is outstanding and well suited for hiding information quickly. The tests showed that the capacity is slightly worse though.

Aim: This study aims to explore the knowledge hiding phenomenon among project teammembers in the consulting industry. This study investigated why, when, how and what type ofknowledge team members hide.Methodology: This research applied a qualitative research with inductive approach. Semistructuredinterviews with eleven participants from EY in Kazakhstan were conducted.Secondary data was obtained from existing scientific articles and books.Findings: Findings of the study provided that (i) variables affecting knowledge hiding atindividual level also influence at team level; (ii) the technological and organizational barriershad a minor influence on knowledge hiding at team level; (ii) tacit/explicit and key/commonknowledge are subject to hiding among team members; (iv) three additional variables arediscovered at team level, i.e. laziness, fear of being seen silly and self-study. Theoretical contributions: This study contributes to the counterproductive knowledgebehaviour by exploring patterns of knowledge hiding among team members. Additionalknowledge sharing barriers of why and when team members hide knowledge were found. Teammembers hide knowledge when they feel ownership over knowledge and territoriality servesas a mediating tool. Nevertheless, collective knowledge psychological ownership weakensknowledge hiding, because team’s success is more important than individual’s goals.Managerial implications: Organizations are encouraged to nurture team environment, becauseteam members might feel that they are obliged to share their knowledge. Also, managementshould consider to lower territoriality perspectives (e.g. by team buildings, etc.). Limitations and future research: Future research should increase the number of respondentsfrom different companies, industries and geographical areas. To validate the three newly foundknowledge hiding variables at team level, they can be tested at individual level. On top of thatfuture research can focus on the effects of interpersonal injustice on knowledge hiding on eachmember, motivational process on knowledge concealing/sharing and cross-cultural differencesof how knowledge concealing is interpreted can be researched.