Publications | Dr. Graeme B Bell http://graemebell.net/publications/ Graeme's publication list en-us Strengthening CAPTCHA-based Web security http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=bell2012fm Simple, universally applicable strategies can help any captcha-protected system resist automated attacks and can improve the ability of administrators to detect attacks. The strategies discussed here cause an exponential increase in the difficulty faced by automated attackers, while only increasing the inconvenience for human users in an approximately linear manner. These strategies are characterised using a new metric, the 'Captcha Improvement Ratio'. The paper concludes that presenting multiple captcha systems together in random order may provide quantitative and qualitative advantages over many typical present-day captcha systems. Digital Whistleblowing in Restricted Environments http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=whistleblowing-gbb2010 The exposure of an organisation's illegal or unethical practices is often known as whistleblowing. It is currently a high- profile activity as a consequence of whistleblowing websites such as Wikileaks. However, modern digital fingerprinting technologies allow the identification of the human users associated with a particular copy of a leaked digital file. Fear of such discovery may discourage the public from exposing illegal or unethical practices. This paper therefore introduces the novel whistleblower- defending problem, a unique variant of the existing document-marking and traitor-tracing problems. It is addressed here by outlining practical steps that real-world whistleblowers can take to improve their safety, using only standard desktop OS features. ZIP compression is found to be useful for indirect file comparison, in cases where direct file comparison or use of checksums is impossible, inconvenient or easily traceable. The methods of this paper are experimentally evaluated and found to be effective. A New CAPTCHA Interface Design for Mobile Devices http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=rsgy-auic2011 This paper discusses and demonstrates the interplay between system security and user interface convenience in CAPTCHA design, and in particular, mobile device CAPTCHA design. A CAPTCHA is a computer-based security test used to distinguish human users from artificial users, preventing automated abuse of networked resources. As mobile network services improve, we can anticipate that future mobile network services will come under attack from automated programs. Importantly, while CAPTCHA techniques have existed for Internet services for some time, only limited work has been carried out to establish CAPTCHAs suitable for mobile device interfaces. The Drawing CAPTCHA (2006) is one of the most well known systems of this type. Unfortunately, though it is straightforward, it is not secure. To demonstrate this, an image-processing technique is newly proposed that breaks the Drawing CAPTCHA. A new CAPTCHA approach is then introduced here which is intended specifically for mobile devices. Experimental results suggest that this new CAPTCHA design is user-friendly as well as secure. Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery? http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=bellbodd2010 Digital evidence is increasingly relied upon in computer forensic examinations and legal proceedings in the modern courtroom. The primary storage technology used for digital information has remained constant over the last two decades, in the form of the magnetic disc. Consequently, investigative, forensic, and judicial procedures are well-established for magnetic disc storage devices (Carrier, 2005). However, a paradigm shift has taken place in technology storage and complex, transistor-based devices for primary storage are now increasingly common. Most people are aware of the transition from portable magnetic floppy discs to portable USB transistor flash devices, yet the transition from magnetic hard drives to solid-state drives inside modern computers has so far attracted very little attention from the research community.Here we show that it is imprudent and potentially reckless to rely on existing evidence collection processes and procedures, and we demonstrate that conventional assumptions about the behaviour of storage media are no longer valid. In particular, we demonstrate that modern storage devices can operate under their own volition in the absence of computer instructions. Such operations are highly destructive of traditionally recoverable data. This can contaminate evidence; can obfuscate and make validation of digital evidence reports difficult; can complicate the process of live and dead analysis recovery; and can complicate and frustrate the post recovery forensic analysis.Our experimental findings demonstrate that solid-state drives (SSDs) have the capacity to destroy evidence catastrophically under their own volition, in the absence of specific instructions to do so from a computer. A method for automatic identification of signatures of steganography software http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=tifs10-bl A fully automated, blind, media-type agnostic approach to steganalysis is presented here. Steganography may sometimes be exposed by detecting automatically characterized regularities in output media caused by weak implementations of steganography algorithms. Fast and accurate detection of steganography is demonstrated experimentally here across a range of media types and a variety of steganography approaches. The dangers of webcrawled datasets http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=datasets-gbb2010 This article highlights legal, ethical and scientific problems arising from the use of large experimental datasets gathered from the Internet - in particular, image datasets. Such datasets are currently used within research into topics such as information forensics and image processing. This paper strongly recommends against Webcrawling as a means for generating experimental datasets, and proposes safer alternatives. An Efficient Segmentation Algorithm for CAPTCHAs with Line Cluttering and Character Warping http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=mta-hlbo10 A CAPTCHA is a test designed to distinguish computer programs from human beings, in order to prevent the abuse of networked resources. Academic research into CAPTCHAs includes designing friendly and secure CAPTCHA systems and defeating existing CAPTCHA systems. Traditionally, defeating a CAPTCHA test requires two procedures: segmentation and recognition. Recent research shows that the problem of segmentation is much harder than recognition. In this paper, two new segmentation techniques called projection and middle-axis point separation are proposed for CAPTCHAs with line cluttering and character warping. Experimental results show the proposed techniques can achieve segmentation rates of about 75%. An Advanced Least-Significant-Bit Embedding Scheme for Steganographic Encoding http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=lbhws-pvist2009 The advantages of Least-Significant-Bit (LSB) steganographic data embedding are that it is simple to understand, easy to implement, and it results in stego-images that contain hidden data yet appear to be of high visual fidelity. However, it can be shown that under certain conditions, LSB embedding is not secure at all. The fatal drawback of LSB embedding is the existence of detectable artefacts in the form of pairs of values (PoVs). The goals of this paper are to present a theoretic analysis of PoVs and to propose an advanced LSB embedding scheme that possesses the advantages of LSB embedding suggested above, but which also provides an additional level of communication security. The proposed scheme breaks the regular pattern of PoVs in the histogram domain, increasing the difficulty of steganalysis and thereby raising the level of security. The experimental results show that both the Chi-square index and RS index are less than 0.1, i.e., the hidden message is undetectable by the well-known Chi-square and RS steganalysis attacks. A Projection-based Segmentation Algorithm for Breaking MSN and YAHOO CAPTCHAs http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=icsie08-hlbo Defeating a CAPTCHA test requires two procedures: segmentation and recognition. Recent research shows that the problem of segmentation is much harder than recognition. In this paper, a new projection-based segmentation algorithm is proposed for the MSN and Yahoo CAPTCHAs. Experimental results show that the proposed algorithm can improve correct segmentation rates ranging from 9% to 14% over the traditional one. The Existence of Local Minima in Local-Minimum-Free Potential Surfaces http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=taros05-bl Existing approaches to potential field based navigation, such as (Khatib, 1986) and (Rimon and Koditschek, 1992), have traditionally seen the local minimum problem as the only significant obstacle. This is because they have concentrated on the problem of classical local minima, characterised by a positive definite Hessian. This paper demonstrates, via the notion of saddle minimum, that the navigational problems associated with local minima can also arise in connection with points other than classical local minima. The existing approaches, in concentrating on the classical definition, do not acknowledge or address such local minimum problems. Forward Chaining for Potential Field Based Navigation http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=gbbthesis05 A key ability for any real world robotic agent and for many simulated agents in virtual environments is the ability to navigate successfully to goal positions within their world. It is often necessary to do this in the presence of obstacles that limit access to parts of the agent's world. This thesis addresses the problem of agent navigation in the situation where an agent is seeking a goal in the presence of obstacle configurations. Potential fields are used to model the navigational problems, and purely potential field based heuristics are given as solutions. Existing potential field based techniques and alternative navigation approaches are shown to lack certain desirable properties that might allow them to be considered completely successful. The general problem of potential field navigation is addressed here using subgoal chaining. A series of novel potential field based subgoal selection heuristics are developed that guide the agent to success in the presence of the stated problem conditions. Development of the heuristic begins by modelling a solution for the simplest two dimensional environments, and then extending it to solutions for problems of greater complexity. The techniques developed here are shown to be successful on a wide variety of problems. Applications for these solutions are suggested in robotics, animation and computer games as well as in other areas of potential field research such as neural networks. Suggestions are given for ways in which competing techniques within navigation can be augmented by applying the results of this research. The remaining problems for potential field based agent navigation are highlighted for future study. Agent Navigation Using Potential Fields and Forward Chaining http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=prep-bw-2004 Increasingly competent heuristics produce the novel Forward Chaining heuristic, allowing navigation past obstacle configurations that are impossible for traditional potential field methods. Forward Chaining for Robot and Agent Navigation using Potential Fields http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=acsc2004-bell The ability to navigate successfully is a crucial part of the behaviour of many agents and systems, ranging from robots and computer game characters to neural networks. Navigation in robotics is addressed here using an approach that is extensible to other areas. Potential fields are acknowledged to be a very powerful representation of robot navigation environments. This representation has been largely abandoned though, due to its susceptibility to premature termination of progress caused by local minima. We seek to encourage the reopening of research into this method by introducing a new approach called Forward Chaining. This technique avoids premature termination of progress by dynamically reshaping the potential field using subgoals which chain forwards towards the goal. A number of increasingly competent and robust navigation heuristics yielding efficient paths are demonstrated. Various avenues for future research are given. The Incorporation of Intentional Action into Robots http://graemebell.net/publications//index.php?action=showcategory&by=ID&pub=bellweir2001 Robot design has recently become a burgeoning area of research for intelligent computation and applications range over diverse scales, from robot insects to Mars explorers. Despite the human associations, standard robot dynamics has more in common with inanimate action than animate action. The Carnegie Trust Scholarship Research Project described herein is intended to redress the balance by addressing the question: How does a robot become able to act intentionally?