Publications

The following publications and presentations are co-authored by members of the UAB Computer Forensics Research Laboratory or were enabled by data from the UAB CFRL.  Our lab works closely with other labs at UAB, especially the Knowledge Discovery & Data Mining Laboratory run by Dr. Chengcui Zhang and Dr. Alan Sprague, and the Natural Language Processing Laboratory run by Dr. Thamar Solorio.  We also collaborate closely with members of the UAB CIS-JS Working Group, which partners faculty and researchers from the Department of Computer & Information Sciences and the Department of Justice Science.

Wardman, B., Warner, G., McCalley, H., Turner, S., Skjellum, A. (2010)
“Reeling in Big Phish with a Deep MD5 Net," Journal of Digital Forensics, Security and Law. 5(3).

Blum, A., Wardman, B., Solorio, T. & Warner, G. (2010). Lexical feature based phishing URL            detection using online learning. 3rd Workshop on Artificial Intelligence and Security,  Chicago, IL.

Tanner, B. & Warner, G.  (2010, October). Koobface: The evolution of a social botnet.  eCrime Researchers Summit, Dallas, TX

Warner, G., McCalley, H., Wardman, B. & Sonwalkar, Jui (2010, October). Seven phases of phishing investigations. Digital Crimes Consortium, Montreal, Canada.

Wei, C., Sprague, A., Warner, G., & Skjellum, A. (2010). Identifying new spam domains by    hosting IPs: Improving domain blacklisting. 7th Annual Collaboration, Electronic Messaging, Anti-Abuse, and Spam Conference, Mountain View, CA.

Wardman, B., Warner, G. & McCalley, H. (2010, May).  Automated crime provenance           tracking through phishing kit identification and clustering. Counter eCrime Operations     Summit, SaoPaulo, Brazil.  

Warner, G. (2010, May). Phishing intelligence: Challenges and directions. Counter eCrime    Operations Summit (CECOS), Sao Paolo, Brazil.

Warner, G. (2010, May). SEO, SEP, and Malvertising: What’s a consumer to do? Counter     eCrime Operations Summit, Sao Paolo, Brazil.

Wei, C., Sprague, A., Warner, G.  & Skjellum, A. (2010). Clustering spam domains and destination websites: Digital forensics with data mining. Journal of Digital Forensics, Security and Law, 5, 26-57.  

Sheng, S., Wardman, B., Warner, G., Cranor, L., Hong, J., & Zhang, C (2009, July). An  empirical analysis of phishing blacklists. 6th Annual Conference on Email and Anti-Spam  (CEAS), Mountain View, CA.

 Wei, C., Sprague, A., Warner, G., & Skjellum, A. (2009, July). Characterization of spam         advertised website hosting strategy. 6th Annual Conference on Email and Spam.

Zhang, C., Wei-Bang, C., Xin, C., Tiwari, R., Lin, Y., & Warner, G. (2009). A multimodal         data mining framework for revealing common sources of spam images. Journal of             Multimedia, 4, 313-320.

Wei-Bang, C. & Zhang, C. (2009, October). Image spam clustering: An unsupervised approach.  Association of Computing Machinery Workshop on Multimedia in Forensics,    Beijing, China.

Wei, C., Sprague, A., & Warner, G. (2009, November). Clustering malware-generated spam emails with a novel fuzzy string matching algorithm.  Proceedings of the Association of Computing Machinery Symposium on Applied Computing, Honolulu, HI.

Zhang, C., Chen, X., Wei-Bang, C., Yang, L. & Warner, G. (2009).  Spam image clustering for identifying common sources of unsolicited emails. International Journal of Digital Crime and Forensics, 1, 1-20.

Zhang, C., Wei-Bang, C., Chen, X., & Warner, G. (2009, March).  Revealing common sources of image spam by unsupervised clustering with visual features. Proceedings of the Association of Computing Machinery Symposium on Applied Computing, Honolulu,     HI.

Wardman, B. & Warner, G. (2008, October).  Automating phishing website identification through deep MD5 matching.  eCrime Researchers Summit, Atlanta, GA.

Wei, C., Sprague, A., Warner, G. & Skjellum, A. (2008, March). Origins for forensic    application. Proceedings of the Association of Computing Machinery Symposium on Applied Computing, Fortaleza, Ceará, Brazil.

Wei, C., Sprague, A. & Warner, G. (2008, March).  Detection of network blocks used by the Stormworm botnet.  Proceedings of ACM Southeast Conference, Auburn, AL.