According to the latest Verizon DBIR report, credential abuse, including password reuse and human factors in password creation, remains the leading attack vector. It was revealed that most users change their passwords only when they forget them, and 35% of respondents find mandatory password rotation policies inconvenient. These findings highlight the importance of combining technical solutions with user-focused education to strengthen password security. In this research, the “human factor in the creation of usernames and passwords” is considered a vulnerability, as identifying the patterns or rules used by users in password generation can significantly reduce the number of possible combinations that attackers need to try in order to gain access to personal data. The proposed method based on an LSTM model operates at a character level, detecting recurrent structures and generating generalized masks that reflect the most common components in password creation. Open datasets of 31,000 compromised passwords from real-world leaks were used to train the model and it achieved over 90% test accuracy without signs of overfitting. A new method of evaluating the individual password creation habits of users and automatically fetching context-rich keywords from a user’s public web and social media footprint via a keyword-extraction algorithm is developed, and this approach is incorporated into a web application that allows clients to locally fine-tune an LSTM model locally, run it through ONNX, and carry out all inference on-device, ensuring complete data confidentiality and adherence to privacy regulations.

In digital forensics, one of the complicated tasks is analyzing web browser data due to different types of devices, browsers, and the absence of modern analytical approaches. Browsers store a large amount of information about user activity because users most often access the internet through them. However, existing approaches to analyzing this browser data still have gaps. Existing approaches fail to provide a comprehensive and precise representation of user activity. This article examines the internal architecture of web browsers as stored in the memory and storage subsystems of various devices, including desktop and mobile platforms. A novel method is proposed that integrates machine learning algorithms, such as k-nearest neighbors and Naive Bayes, to automatically analyze browser data, identify suspicious login activities, and construct user behavior profiles. The results indicate that the proposed method and the developed platform can effectively construct individual user behavior profiles. Moreover, this approach not only productively observes top visited domains and main user’s favorite website categories, but also highlights suspicious websites and user’s login attempts. Compared to existing browser forensic tools which have less capabilities, the proposed technique provides increased accuracy (more than 90%) in automated user profiling and detection of suspicious user activity.

In digital forensics, one of the complicated task is analyzing web browser data due to different types of devices, browsers and no updated approaches. Browsers store a large amount of information about user activity because users most often access the internet through them. However, existing approaches to analyzing this browser data still have gaps. One of the main problem developed platforms based on the old methods can not show complete information about the user's activity and have issues with precision. The article discusses the internal architecture of the browser, which is stored in the memory drives inside devices, for instance, computers or mobile devices. The research paper offers solution with developed module based on new method which integrates machine learning algorithms, such as K-NN algorithm and Naive Bayes. The main purpose of the paper it is shows new method which can automatically analyzes browser's data, detects suspicious login activity, and generates user behavior profile. The results show that the proposed new method , on which the developed platform is based, demonstrates user's profile by interests, emotional state and financial state. Also it possible to see list of top visited domain and main user's favorite website categories. It has been found that our methods shows with high accuracy 99.9\% . Also the result of new method , on which the developed platform is based shows the suspicious web-sites and user's logins. Compared to Oxygen Forensics and Nirsoft which less capabilities., the proposed method provides increased accuracy , automated user profiling and detection of suspicious user's activity.

Software piracy and reverse engineering cause significant damage to intellectual property: the commercial value of unlicensed software installed worldwide has been estimated at over USD 46 billion. Traditional protection methods rely on static encryption keys or on obfuscation, and they are not resistant to modern analysis techniques such as differential computation analysis (DCA). This study addresses the single point of failure in software protection systems by developing a new key management architecture. The paper introduces a distributed split-key software-hardware framework. A deterministic decryption key is divided into three parts: a local key derived from the unique properties of the machine's hardware (hardware fingerprint), a server key issued after authenticated online activation, and a key sealed in a Trusted Platform Module (TPM) and bound to the platform's Platform Configuration Registers (PCRs). The final key is assembled exclusively in RAM during program execution through an XOR operation and is erased immediately after use. A C#/.NET 8 reference implementation was evaluated on a single Windows platform with a discrete TPM 2.0 module. Changing any of the five hardware identifiers or the PCR state prevented decryption, the assembled key remained in memory for a median of 15.6 µs, key assembly took 0.3 µs, and the one-time TPM sealing took about 67 ms. The runtime overhead stayed below 5% for typical protected functions. The analysis also identifies the remaining limitations of the design: code harvesting through legitimate decryption, binary patching that does not affect PCR 0 and PCR 7, clock rollback during the offline grace period, and loss of access after legitimate firmware or Secure Boot updates. The framework binds execution to authorized hardware and raises the cost of reverse engineering.