In the light of increased network attacks, payload attribution is an essential part of any forensics analysis of the attack. Usually attribution has to be done based on the payload of the packets. In such techniques network traffic should be stored in its entirety while user privacy is preserved. Bloom filters have been an ideal tool for such requirements. Previous works in this area have tried to minimize the false positive error rate associated with the bloom filter while improving on the data reduction ratio but there has not been any notable research on practical implementations in computer networks. A payload attribution technique should provide a list of connections which are suspects of carrying a specific payload (i. e. malware signature). The problem arises with the fact that there are too many queries required, given the large number of connections and the number of bloom filters involved over long time periods, which results in a large aggregate error rate. In this work, we propose a technique with which a time-based hierarchical bloom filter configuration is proposed to tackle the noted problem. Our evaluation shows that with this proposed technique we are able to limit the false positive error rate of the system as compared to the previously proposed techniques. This leads to an overall error reduction in the payload attribution system. More specifically, the error rate compared to previous work drops from 5. 66% to 3. 98% which results in reducing the number of incorrectly identified flows by 8400.

In obtaining digital evidence, one has to take many different steps. Regarding this, criminal systems still have not agreed upon a unique standard, particularly in the case of digital evidences. Digital forensics, as a science concerning the processes of obtaining evidence, proposes anti-forensic methods that, if they are paid attention to, countries can make their laws more technical in terms of content. Unfortunately, digital forensics does not have a favourable situation in terms of theory and practice. In this respect, the weakness of Acts and instruments such as the Iranian criminal procedure Act and the regulations regarding collecting electronic evidence is apparent. This essay has examined the challenges in digital forensics with a descriptive approach and seeks to approximate them by applying the rules of Iran and English criminal systems.

Background and Aim: In recent decades, biometric technologies have played a significant role as precise and unique tools in identity verification and forensics. The aim of this research is to present a coherent model for utilizing biometric characteristics in the forensics cycle to enhance the accuracy and speed of crime detection. Method: This applied research is exploratory in nature and, in terms of its execution approach, falls under mixed-methods research. The qualitative part consisted of two sections: In the first qualitative section, documents and records that addressed the state of biometrics utilization in forensics in Iran and leading countries were used. In the second section, 16 expert specialists in the fields of crime detection, forensic medicine, identity verification, biometrics, FATA Police, information technology, and cybersecurity participated. They were selected purposefully, and semi-structured interviews continued until theoretical saturation was reached. Data were analyzed using thematic analysis. After accurate transcription, basic themes were extracted and organized, and to ensure validity, the criteria of Lincoln and Guba (focusing on credibility and confirmability) were utilized. The statistical population for the quantitative part included key experts and specialists in the fields of biometrics and forensics. The sample size was determined as 103 individuals using Cochran's formula and purposive stratified sampling. The data collection tool for the quantitative part was a researcher-made questionnaire, for which the Cronbach's alpha coefficient indicated high reliability and trustworthiness. Data were analyzed using SPSS software and inferential statistical methods. Findings: According to the findings, the derived model comprises four main dimensions: "Identification and Matching of Offenders' Identity," "Analysis of Criminal Behavior and Patterns," "Utilization of Biometrics in Crime Prevention," and "Protection of Biometric Data and Privacy Issues." The use of technologies such as hand vein scanners, 3D cameras, artificial intelligence algorithms, and international systems has reduced errors and increased accuracy in identification. Furthermore, the combined analysis of biometric data, criminal psychology, and geographical data enables effective crime prediction and prevention. Conclusion: Widespread use of advanced biometric technologies, along with legal and ethical frameworks, paves the way for transformation in the forensics system and the enhancement of social security. The development of intelligent systems, continuous training, and gaining public trust will be the key to the successful implementation of the proposed model in Iran.

Advances in the digital world are leading us to the development of digital forensic tools. The use of machine learning methods for source printer identification is one of the sub-fields of this area that is being developed. In this paper, a new method for extracting secondary features based on identity vector or i-vector to identify the print source is presented. In the proposed method, the classification process is accelerated only by extracting a low-dimension i-vector vector per page, without the use of optical character recognition (OCR) method, and by eliminating majority voting. Furthermore, the proposed method in extracting features is independent of the type and size of the font and the language of the text. Secondary features are obtained by splitting the document image into smaller patches and modeling the primary LBP features of the dark, border, and light areas in separate spaces. Modeling the primary features of different regions in separate total variability printer space makes it possible to extract class discriminator information from the remaining print texture in the bright area to increase classification accuracy. In this paper, the effect of using the texture of different regions and changing the patch dimensions using the SVM (Support Vector Machine) classifier through simulation has been carefully investigated. The simulation results show that only by refining the basic features of LBP we achieved 99. 05% accuracy, which is more than the latest research in this field.

Background and Aim: Trial in intentional and unintentional crimes is one of the most multifaceted issues in criminal law and Forensic medicine, as well as the involvement of causes that ascend from the characteristics of the culprit and within the committer and as grounds. They reproduce this complexity in terms of their attendance or absence of interconnection and how they disturb it. This article deals with the trials facing criminal law and forensic medicine in relation to the grounds intricate in the crime and in view of the importance and obligation of the issue in terms of disagreement about the role of the grounds in the judicial process. This article aims to provide an appropriate prototypical of how the context plays the role while investigating some of the sentiments related to the context. Materials and Methods: This descriptive-analytical article has been equipped and compiled by means of the documentary method and using the note tool. Results: The findings designate that,The underlying cause with the proficient opinion of forensic physicians along with the foreman or other causes can be elevated by playing a creative role in achieving the criminal consequence, but in most cases the fundamental cause is hurrying, accelerating or escalating the effect of the foreman's act or other It is a cause and in such cases the submission of the title to the existing setting and the fortitude of the share as a result is not adequate, but it can be considered along with the steward or other causes for it, although some legal systems By completely vacating the role of the underlying cause, they do not subsidize to this cause under any circumstances. Ethical considerations: From the commencement to the end of the article has been equipped and compiled with adherence to the values of honesty and reliability. Conclusion: In view of the silence of the law in the Iranian legal system and on the other hand the lack of obvious jurisprudential rules on the role and consequence of the underlying causes, in exploratory the judicial procedure of Iranian criminal courts, on the one hand we see divergence of opinions that some courts, Have not accepted the effect of the underlying cause and others, based on forensic concepts, have accepted that in many cases the jurisprudence has accepted the role and share for the underlying cause which only had an aggravating or accelerating role in the crime. Have diverged from the path of fairness and justice and the adherence of the principle of fairness of persons, and it is necessary for the legislator to enact the essential laws and take advantage of medical advances in this regard, while culmination the fragmentation of judicial technique, the rule of thin skull Which is putative in most legal systems, in order to protect the scrawnier and more justified cause.