Search Results (916)

Technical job interviews have become a vulnerable environment for social engineering attacks, particularly when they involve direct interaction with malicious code. In this context, the present manuscript investigates an exploratory case study, aiming to provide an in-depth analysis of a single incident rather than seeking to generalize statistical evidence. The study examines a real-world covert attack conducted through a simulated interview, identifying the technical and psychological elements that contribute to its effectiveness, assessing the performance of artificial intelligence (AI) assistants in early detection and proposing mitigation strategies. To this end, a methodology was implemented that combines discursive reconstruction of the attack, code exploitation and forensic analysis. The experimental phase, primarily focused on evaluating 10 large language models (LLMs) against a fragment of obfuscated code, reveals that the malware initially evaded detection by 62 antivirus engines, while assistants such as GPT 5.1, Grok 4.1 and Claude Sonnet 4.5 successfully identified malicious patterns and suggested operational countermeasures. The discussion highlights how the apparent legitimacy of platforms like LinkedIn, Calendly and Bitbucket, along with time pressure and technical familiarity, act as catalysts for deception. Based on these findings, the study suggests that LLMs may play a role in the early detection of threats, offering a potentially valuable avenue to enhance security in technical recruitment processes by enabling the timely identification of malicious behavior. To the best of available knowledge, this represents the first academically documented case of its kind analyzed from an interdisciplinary perspective. Full article

The merging of the Internet of Things (IoT) and Artificial Intelligence (AI) advances has intensified challenges related to data authenticity and security. These advancements necessitate a multi-layered security approach to ensure the security, reliability, and integrity of critical infrastructure and intelligent surveillance systems. This paper proposes a two-layered security approach that combines a discrete cosine transform least significant bit 2 (DCT-LSB-2) with artificial neural networks (ANNs) for data forensic validation and mitigating deepfakes. The proposed model encodes validation codes within the LSBs of cover images captured by an IoT camera on the sender side, leveraging the DCT approach to enhance the resilience against steganalysis. On the receiver side, a reverse DCT-LSB-2 process decodes the embedded validation code, which is subjected to authenticity verification by a pre-trained ANN model. The ANN validates the integrity of the decoded code and ensures that only device-originated, untampered images are accepted. The proposed framework achieved an average SSIM of 0.9927 across the entire investigated embedding capacity, ranging from 0 to 1.988 bpp. DCT-LSB-2 showed a stable Peak Signal-to-Noise Ratio (average 42.44 dB) under various evaluated payloads ranging from 0 to 100 kB. The proposed model achieved a resilient and robust multi-layered data forensic validation system. Full article

MicroRNAs (miRNAs) are small non-coding RNA molecules approximately 20–22 nucleotides in length that regulate gene expression at the post-transcriptional level. By binding to target messenger RNAs (mRNAs), miRNAs inhibit translation or induce degradation, thus influencing a wide array of biological processes including development, inflammation, apoptosis, and tissue remodeling. Owing to their remarkable stability and tissue specificity, miRNAs have emerged as promising biomarkers in both clinical and forensic settings. In recent years, increasing evidence has demonstrated their utility in cardiovascular diseases, where they may serve as diagnostic, prognostic, and therapeutic tools. This systematic review aims to comprehensively summarize the role of miRNAs in cardiovascular pathology, focusing on their diagnostic potential in myocardial infarction, sudden cardiac death (SCD), and cardiomyopathies, and their applicability in post-mortem investigations. Following PRISMA guidelines, we screened PubMed, Scopus, and Web of Science databases for studies up to December 2024. The results highlight several miRNAs—including miR-1, miR-133a, miR-208b, miR-499a, and miR-486-5p—as robust markers for ischemic injury and sudden death, even in degraded or formalin-fixed autopsy samples. The high stability of miRNAs under extreme post-mortem conditions reinforces their potential as molecular tools in forensic pathology. Nevertheless, methodological heterogeneity and limited standardization currently hinder their routine application. Future studies should aim to harmonize analytical protocols and validate diagnostic thresholds across larger, well-characterized cohorts to fully exploit miRNAs as reliable molecular biomarkers in both clinical cardiology and forensic medicine. Full article

Automotive dashboard cameras are widely used to record driving events and often serve as critical evidence in accident investigations and insurance claims. However, the availability of free and low-cost editing tools has increased the risk of video tampering, underscoring the need for reliable methods to verify video authenticity. Temporal tampering typically involves manipulating frame order through insertion, deletion, or duplication. This paper proposes a computationally efficient framework that transforms high-dimensional video into compact one-dimensional temporal signals and learns tampering patterns using a shallow one-dimensional convolutional neural network (1D-CNN). Five complementary features are extracted between consecutive frames: frame-difference magnitude, structural similarity drift (SSIM drift), optical-flow mean, forward–backward optical-flow consistency error, and compression-aware temporal prediction error. Per-video robust normalization is applied to emphasize intra-video anomalies. Experiments on a custom dataset derived from D²-City demonstrate strong detection performance in single-attack settings: 95.0% accuracy for frame deletion, 100.0% for frame insertion, and 95.0% for frame duplication. In a four-class setting (non-tampered, insertion, deletion, duplication), the model achieves 96.3% accuracy, with AUCs of 0.994, 1.000, 0.997, and 0.988, respectively. Efficiency analysis confirms near real-time CPU inference (≈12.7–12.9 FPS) with minimal memory overhead. Cross-dataset tests on BDDA and VIRAT reveal domain-shift sensitivity, particularly for deletion and duplication, highlighting the need for domain adaptation and augmentation. Overall, the proposed multi-feature 1D-CNN provides a practical, interpretable, and resource-aware solution for temporal tampering detection in dashcam videos, supporting trustworthy video forensics in IoT-enabled transportation systems. Full article

Memory resident malware, particularly fileless and heavily obfuscated types, continues to pose a major problem for endpoint defense tools, as these threats often slip past traditional signature-based detection techniques. Deep learning has shown promise in identifying such malicious activity, but its use in real Security Operations Centers (SOCs) is still limited because the internal reasoning of these neural network models is difficult to interpret or verify. In response to this challenge, we present HAGEN, a hierarchical attention architecture designed to combine strong classification performance with explanations that security analysts can understand and trust. HAGEN processes memory artifacts through a series of attention layers that highlight important behavioral cues at different scales, while a gated mechanism controls how information flows through the network. This structure enables the system to expose the basis of its decisions rather than simply output a label. To further support transparency, the final classification step is guided by representative prototypes, allowing predictions to be related back to concrete examples learned during training. When evaluated on the CIC-MalMem-2022 dataset, HAGEN achieved 99.99% accuracy in distinguishing benign programs from major malware classes such as spyware, ransomware, and trojans, all with modest computational requirements suitable for live environments. Beyond accuracy, HAGEN produces clear visual and numeric explanations—such as attention maps and prototype distances—that help investigators understand which memory patterns contributed to each decision, making it a practical tool for both detection and forensic analysis. Full article

Background/Objectives: Snakebite envenoming remains a critical yet frequently under-recognized cause of mortality in many parts of the world, particularly in tropical and rural areas where access to timely medical care and accurate post-mortem investigation is limited. While clinical and epidemiological data on snakebites have been extensively studied, the forensic characterization of fatal envenomations remains fragmentary and inconsistently documented. This review aims to synthesize the existing literature on autopsy-confirmed snakebite deaths, focusing on the pathological and toxicological evidence that supports cause-of-death determinations in forensic settings. Methods: A comprehensive search of the PubMed NCBI databases identified nine relevant studies, including case reports, retrospective analyses, and systematic reviews. Results: Across these reports, a range of lethal mechanisms were identified, including venom-induced consumption coagulopathy (VICC), acute renal failure (frequently in the setting of rhabdomyolysis and acute tubular necrosis), neurotoxic respiratory arrest, multi-organ necrosis, and myocardial infarction. Histological findings frequently revealed glomerular and tubular necrosis, pulmonary edema and/or hemorrhage, pituitary and adrenal hemorrhage, and cerebral ischemic changes. Toxicological confirmation was achieved in several cases using ELISA and liquid chromatography–mass spectrometry (LC–MS/MS), underscoring the importance of biochemical validation in post-mortem diagnosis and the value of analytical tools beyond ELISA (e.g., immunoaffinity LC–MS/MS, venom-specific immunohistochemistry, zymography for SVMP activity). Conclusions: Our findings highlight the variability in venom effects across snake families—particularly Viperidae, Elapidae, and Lamprophiidae/Atractaspididae—and emphasize the indispensable role of forensic autopsy in distinguishing snakebite envenoming from other causes of sudden or unexplained death. However, significant limitations persist, including inconsistent autopsy protocols, lack of species-specific venom assays, and poor integration of toxicological methods in routine forensic practice. Addressing these gaps through standardized forensic guidelines and improved access to diagnostic tools is essential for enhancing the accuracy of death investigations in envenoming-endemic regions. Full article

This investigation provides a critical analysis of the digital forensics field within the Kingdom of Saudi Arabia (KSA), specifically focusing on its educational systems, and the effectiveness of prosecutorial efforts. Utilizing a mixed-methodology framework and extensive literature reviews, this study reveals pronounced deficiencies in digital forensics against increased cybercrime activities. Furthermore, it highlights a general lack of preparedness among digital forensics professionals in KSA and notes significant variations in forensic applications across different judicial and educational contexts. The research recommends creating a uniform national educational framework for digital forensics, improving professional training programs, and strategically enhancing forensic technologies. Through a thorough analysis of demographic trends, educational programs, and adherence to procedural standards, this study proposes targeted strategies to fortify the digital forensic infrastructure of KSA, aligning with the strategic imperatives of Vision 2030. Full article

Sudden cardiac death (SCD) remains a major challenge in forensic medicine, representing a leading cause of natural mortality and frequently occurring in individuals without antecedent symptoms. Although conventional autopsy and histology remain the cornerstones of investigation, up to 10–15% of cases are classified as “autopsy-negative sudden unexplained death,” underscoring the need for complementary diagnostic tools. In recent years, post-mortem biochemistry and molecular approaches have become essential to narrowing this gap. Classical protein markers of myocardial necrosis (cardiac troponins, CK-MB, H-FABP, GPBB) continue to play a fundamental role, though their interpretation is influenced by post-mortem interval and sampling site. Peptide biomarkers reflecting hemodynamic stress (BNP, NT-proBNP, copeptin, sST2) offer additional insight into cardiac dysfunction and ischemic burden, while inflammatory and immunohistochemical markers (CRP, IL-6, fibronectin, desmin, C5b-9, S100A1) assist in detecting early ischemia and myocarditis when routine histology is inconclusive. Beyond these traditional markers, molecular signatures—including cardiac-specific microRNAs, exosomal RNA, proteomic alterations, and metabolomic fingerprints—provide innovative perspectives on metabolic collapse and arrhythmic mechanisms. Molecular autopsy through next-generation sequencing has further expanded diagnostic capability by identifying pathogenic variants associated with channelopathies and cardiomyopathies, enabling both cause-of-death clarification and cascade screening in families. Emerging multi-omics and artificial intelligence frameworks promise to integrate these heterogeneous data into standardized and robust interpretive models. Pre- and post-analytical considerations, together with medico-legal implications ranging from malpractice evaluation to the management of genetic information, remain essential components of this evolving field. Overall, the incorporation of validated biomarkers into harmonized international protocols, increasingly supported by AI, represents the next frontier in forensic cardiology. Full article

Wide thermal cracks are a common form of pavement distress affecting primary state and county highways, urban residential streets, and parking lots across the Southwest climatic regions. These cracks are primarily caused by thermal fatigue, driven by diurnal temperature variations despite the lack of extremely cold events. This research aims to identify and analyze the local factors contributing to the initiation and propagation of thermal fatigue cracks. Field cores are collected from 12 sites exhibiting wide thermal cracks in the Phoenix metropolitan area in Arizona to evaluate their volumetric properties and the degree of binder aging. Advanced finite element (FE) models were developed to examine the influence of pavement structures and local climatic conditions on the development of tensile stresses due to thermal fatigue. The FE analysis indicated a high magnitude of thermal stresses due to cyclic temperature variations in Arizona compared to colder regions in the United States. Based on the forensic investigation and analysis performed, the initiation of wide cracks was shown to be primarily due to repeated localized damage from frequent thermal fatigue events on severely aged pavements. This damage is exacerbated by low air voids in mineral aggregate, an insufficient effective binder volume. and excessive binder aging, which compromise the structural integrity of the pavement. Full article

This paper investigates the flame behavior and smoke pattern characteristics of lithium-ion battery (LIB) fires using an integrated experimental and numerical simulation approach. Based on fire dynamics theory, a jet flame model for LIB thermal runaway (TR) is developed to analyze the flame height and dynamic characteristics. The results reveal two distinct regimes in LIB jet flames: momentum-controlled dominance in the early TR stage (lasting approximately 3 s) and buoyancy-controlled dominance in subsequent combustion. The jet flame shifts from a momentum-dominated regime (Fr > 5) to a buoyancy-dominated plume (Fr < 5) as the vent velocity decays below 12 m/s. The simulated flame heights align with experimental measurements and the Delichatsios model, validating the numerical approach. Furthermore, the distribution of flame components (e.g., H₂, CO, CO₂, CH₄, C₂H₄) is analyzed, highlighting the influence of multi-component gases on combustion heterogeneity. Smoke pattern analysis demonstrates that soot deposition varies significantly between momentum- and buoyancy-controlled stages, with the former producing darker, concentrated deposits and the latter yielding wider, lighter patterns. These findings provide a theoretical basis for forensic fire investigation (accident reconstruction) and targeted suppression strategies for different combustion stages. Full article

Background/Objectives: Forensic DNA phenotyping (FDP) enables the prediction of externally visible characteristics (EVCs) such as eye, hair, and skin color, ancestry, and age from biological traces. However, low template DNA (LT-DNA), often derived from degraded or trace samples, poses significant challenges due to allelic dropout, contamination, and incomplete profiles. This review evaluates recent advances in FDP from LT-DNA, focusing on the integration of machine learning (ML) models to improve predictive accuracy and operational readiness, while addressing ethical and population-related considerations. Methods: A comprehensive literature review was conducted on FDP and ML applications in forensic genomics. Key areas examined include SNP-based trait modeling, genotype imputation, epigenetic age estimation, and probabilistic inference. Comparative performance of ML algorithms (Random Forests, Support Vector Machines, Gradient Boosting, and deep learning) was assessed using datasets such as the 1000 Genomes Project, UK Biobank, and forensic casework samples. Ethical frameworks and validation standards were also analyzed. Results: ML approaches significantly enhance phenotype prediction from LT-DNA, achieving AUC > 0.9 for eye color and improving SNP recovery by up to 15% through imputation. Tools like HIrisPlex-S and VISAGE panels remain robust for eye and hair color, with moderate accuracy for skin tone and emerging capabilities for age and facial morphology. Limitations persist in admixed populations and traits with polygenic complexity. Interpretability and bias mitigation remain critical for forensic admissibility. Conclusions: L integration strengthens FDP from LT-DNA, offering valuable investigative leads in challenging scenarios. Future directions include multi-omics integration, portable sequencing platforms, inclusive reference datasets, and explainable AI to ensure accuracy, transparency, and ethical compliance in forensic applications. Full article

Phishing websites continue to evolve in sophistication, making them increasingly difficult to distinguish from legitimate platforms and challenging the effectiveness of current detection systems. In this study, we investigate the role of subtle deceptive behavioral cues such as mouse-over effects, pop-up triggers, right-click restrictions, and hidden iframes in enhancing phishing detection beyond traditional structural and domain-based indicators. We propose a hierarchical hybrid detection framework that integrates dimensionality reduction through Principal Component Analysis (PCA), phishing campaign profiling using K Means clustering, and a stacked ensemble classifier for final prediction. Using a public phishing dataset, we evaluate multiple feature configurations to quantify the added value of behavioral indicators. The results demonstrate that behavioral indicators, while weak predictors in isolation, significantly improve performance when combined with conventional features, achieving a macro F1 score of 97 percent. Explainable AI analysis using SHAP confirms the contribution of specific behavioral characteristics to model decisions and reveals interpretable patterns in attacker manipulation strategies. This study shows that behavioral interactions leave measurable forensic signatures and provides evidence that combining structural, domain, and behavioral features offers a more comprehensive and reliable approach to phishing intrusion detection. Full article

The 1992 cold case homicide of “Ina Jane Doe” illustrates how an interdisciplinary team worked to identify the decedent using a combined approach of skeletal re-analysis, updated forensic art informed by anthropologists’ input, archival research, and forensic investigative genetic genealogy. The original forensic art for “Ina Jane Doe” showed an over-pathologization of skeletal features and an inaccurate hairstyle; however, the case gained notoriety on internet true crime forums leading to speculation about the decedent’s intellectual capacity and physical appearance. The “Ina Jane Doe” case demonstrates the importance of advocating for skeletal re-analysis as more robust methods and technologies emerge in forensic science, as well as the impact of sustained public interest in cold cases. In this case, continuous public interest and online speculation led to anthropologists constructing a team of experts to correct and revise narratives about the decedent. Forensic anthropologists’ role in cold cases may include offering skeletal re-analysis, recognizing and correcting errors in the original estimations of the biological profile, searching for missing person matches, and/or working collaboratively with subject matter experts in forensic art, odontology and forensic investigative genetic genealogy. Full article

Accurate post-mortem diagnosis of sepsis remains a critical challenge in forensic pathology, as conventional morphological findings often lack specificity. Circulating microRNAs (miRNAs) have been proposed as stable molecular biomarkers, yet their diagnostic value in cadaveric samples is still unclear. This exploratory study investigated the expression of three candidate miRNAs (miR-122-5p, miR-125b-5p, and miR-27a-3p) in post-mortem peripheral whole blood to assess their association with sepsis-related death versus non-infective controls. Out of 58 cases, 45 met quality-control criteria (26 sepsis-related deaths and 19 controls). miRNA expression was quantified by qRT-PCR, normalized to miR-320, and analyzed using ΔCt values. Group differences were evaluated using linear regression models with adjustment for age, sex, and post-mortem interval, with Benjamini–Hochberg correction for multiple testing. In adjusted models, miR-125b-5p and miR-27a-3p showed evidence of association with sepsis status, whereas miR-122-5p did not. These results support the feasibility of miRNA quantification in post-mortem samples and motivate validation in larger, independent cohorts and within multimodal post-mortem diagnostic frameworks. Full article

The flourishing of the Internet of Things (IoT) has not only improved our lives in smart homes and healthcare but also made us more susceptible to cyberattacks. Legacy intrusion detection systems are simply overwhelmed by the scale and diversity of IoT traffic, which is why there is a need for more intelligent forensic solutions. In this paper, we present a statistical technique, the Averaging Detection Method (ADM), for detecting attack traffic. Furthermore, the five deep learning models SimpleRNN, LSTM, GRU, BLSTM, and BGRU are compared for malicious traffic detection in IoT network forensics. A smart home dataset with a simulated DoS attack was used for performance analysis of accuracy, precision, recall, F1-score, and training time. The results indicate that all models achieve high accuracy, above 97%. BiGRU achieves the best performance, 99% accuracy, precision, recall, and F1-score, at the cost of high training time. GRU achieves perfect precision and recall (100%) with faster training, which can be considered for resource-constrained scenarios. SimpleRNN trains faster with comparable accuracy, while LSTMs and their bidirectional counterparts are better at capturing long-term dependencies but are computationally more expensive. In summary, deep learning, especially BiGRU and GRU, holds great promise for boosting IoT forensic investigation by enabling real-time DoS detection and reliable evidence collection. Meanwhile, the proposed ADM is simpler and more efficient at classifying DoS traffic than deep learning models. Full article