Lawful Evidence Collecting and Continuity Platform Development

About the position

The Department of Information Security and Communication Technology (IIK) at the Norwegian University of Science and Technology (NTNU) invites applications for a Postdoctoral position affiliated with the Critical Infrastructure Security and Resilience group (CISaR). The research will focus on forensics for mobile devices, cloud computing and streaming services, evidence management techniques for digital forensics along with forensics training.

The position is funded by and aligned with the H-2020 project LOCARD (Lawful evidence cOllecting and Continuity plAtfoRm Development) - https://locard.eu/, the goal of which is the development of a holistic platform for chain of custody assurance along the forensic workflow. The system to be developed will integrate a crowd-source module to collect citizen reports of selected violations, a crawler to detect and correlate online deviant behavior, and a toolkit for investigators that will assist them in collecting online and offline evidence. This will be powered by technologies such as Trusted Execution Environment and Blockchain.

Main objectives of the project are :

• to manage digital chain of custody for forensic evidence
• to guarantee the integrity of evidence and chain of custody
• the use of streaming and cloud data as digital evidence
• to provide transparency of chain of custody to customer
• the standardization of digital chain of custody
• to facilitate the use of digital evidence in court
• to enable international (Cross-jurisdictional) usage of digital evidence

The specific focus of this position is on investigating digital forensics landscape and undertaking research on novel mechanisms regarding various sub-domains, such as mobile devices, cloud computing infrastructure, and streaming services/devices. Different challenges exist for each one of these cases, so new approaches have to be designed in order to efficiently perform digital forensic analysis for all of them. Furthermore, training sessions, regarding digital forensics in general and the usage of the LOCARD platform in particular, are going to be designed and will be held in the final year of the project. The successful candidate will work in close collaboration with existing personnel of the CISaR group. 

The position reports to the Head of Department.

Main duties and responsibilities

The successful candidate will work on advancing the state of the art by developing novel mechanisms related to forensics analysis. Research activities will span three different subdomains of forensics, mobile, cloud and streaming services. Specifically the candidate will focus on methods to collect forensic data on mobile devices even in the case that these are locked.

Additionally a mechanism to detect infections on a mobile device will be designed, in order to enable users to investigate possible hijacking of a mobile device. The results of the mechanism will automatically be taken into account into a more general forensic analysis workflow. The candidate will also work on cloud forensics to mitigate specific challenges, such as those associated with data replication, location transparency, and multi-tenancy. In particular, new methodologies for identifying, collecting, preserving, and analyzing evidence in multi-tenant cloud environments that offer rapid provisioning, global elasticity and broad network accessibility will be developed. The candidate will also investigate cybercrime related to streaming, in order to develop new methodologies to collect data from services and prove that, for instance, a service/IP was streaming specific content at a specific time.

Further, methods to perform forensics on devices that are connected to such services on the user side will be explored. The candidate will also be required to work on determining the most suitable identity management and access control methodology to meet the requirements of the LOCARD platform and its stakeholders. An additional contribution will be to study and determine the state of the art for Chain of Custody/Continuity of Evidence management techniques for digital forensics. The candidate will initially study and determine the state of the art, and then will build on and extend beyond the state of the art in designing a blockchain based management system, flexible enough to allow access to the different stakeholders (LEAs, labs, defenses, Court) according to their specific roles and appropriate legislation.

Finally, innovative curricula for training staff of Legal Enforcement Agencies (LEAs) and joint exercises will be developed. Training sessions will be held to provide LEAs personnel with the required knowledge to operate the LOCARD platform and its analysis and intelligence modules.

Qualification requirements

A postdoctoral research fellowship is a qualification position in which the main objective is qualification for work in academic positions. Completion of a Norwegian doctoral degree in Information Security or Computer Science or corresponding foreign doctoral degree recognized as equivalent to a Norwegian doctoral degree is required.

Other qualifications

• Previous experience in forensics domain (mobile forensics, cloud forensics, streaming services forensics) is required. This should be prooven by relevant publications or involvment in relevant projects. Mainly experience in one or more of the following :
• Experience with blockchain technology is required. Applicants should be familiar with blockchain domain and provide evidence that they understand the main concepts of blockchain technology and are able to design blockchain based applications.
• Previous practical experience with Hyperledger Fabric platform will be considered positively. The successful applicant will be required to (partially) implement a forensics workflow management system by using Hyperledger Fabric ecosystem.
• Excellent written and oral communication skills. Applicants who neither are native English speakers nor from Scandinavia, must provide evidence of English language proficiency by means of one of the following tests: TOEFL, Academic IELTS and Cambridge CAE or CPE. Minimum scores need to be:
  • TOEFL: 600 (paper-based test), 92 (Internet-based test)
  • IELTS: 6.5, with no section lower than 5.5 (only Academic IELTS test accepted)
  • CAE/CPE: grade B or A.
• Experience with training will be considered positively.

The appointment is to be made in accordance with the regulations in force concerning State Employees and Civil Servants and national guidelines for appointment as PhD, postdoctor and research assistant.

NTNU is committed to following evaluation criteria for research quality according to The San Francisco Declaration on Research Assessment - DORA.

Personal characteristics

• The successful candidate should be capable of working independently, and with a problem solving mindset.
• Furthermore, the successful candidate should be keen on learning and working in teams in a structured manner, and take initiatives for personal and team growth.
• Additionally, he/she should also enjoy doing interdisciplinary research.

In the evaluation of which candidate is best qualified, emphasis will be placed on education, experience and personal suitability, in terms of the qualification requirements specified in the advertisement.

We offer

• exciting and stimulating tasks in a strong international academic environment
• an open and inclusive work environment with dedicated colleagues
• favourable terms in the Norwegian Public Service Pension Fund
• employee benefits

Salary and conditions

Postdoctoral candidates are remunerated in code 1352, and are normally remunerated at gross NOK 563 700 per year. From the salary, 2% is deducted as a contribution to the Norwegian Public Service Pension Fund.

The period of employment is for up to 2 years and 6 months.

The engagement is to be made in accordance with the regulations in force concerning State Employees and Civil Servants, and the acts relating to Control of the Export of Strategic Goods, Services and Technology. Candidates who by assessment of the application and attachment are seen to conflict with the criteria in the latter law will be prohibited from recruitment to NTNU.

Appointment takes place on the terms that apply to State employees at any time, and after the appointment you must assume that there may be changes in the area of work.

General information

A good work environment is characterized by diversity. We encourage qualified candidates to apply, regardless of their gender, functional capacity or cultural background. Under the Freedom of Information Act (offentleglova), information about the applicant may be made public even if the applicant has requested not to have their name entered on the list of applicants.

For further information, please contact: Professor Sokratis Katsikas, phone number: +47 91138581, e-mail: sokratis.katsikas@ntnu.no, or Dr. Vasileios Gkioulos, phone number: +47 61135162, email: vasileios.gkioulos@ntnu.no

About the application:

Publications and other academic works that the applicant would like to be considered in the evaluation must accompany the application. Joint works will be considered. If it is difficult to identify the individual applicant's contribution to joint works, the applicant must include a brief description of his or her contribution.

Please submit your application electronically via jobbnorge.no with your CV, diplomas and certificates. Applicants invited for interview must include certified copies of transcripts and reference letters.

The application must contain

• Your CV, diplomas and certificates
• Contact details of two references 
• A cover letter describing your suitability for the position, including knowledge and background specifically in digital forensics

Candidates for the Postdoctoral position from non-English speaking countries outside the Nordic countries can provide English proficiency evidence from academic publication, video recording of conference presentations, or other documented evidences.

Application deadline: November 3, 2019

Deadline 3rd November 2019
Employer NTNU - Norwegian University of Science and Technology
Municipality Gjøvik Trondheim
Scope Fulltime
Duration Temporary
Place of service NTNU Campus Gjøvik