Detection of relevant digital evidence in the forensic timelines
Authors:
- 30 June 2022
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 1-7
Abstract
Security incident handling and response are essen-tial parts of every organization's information and cyber security. Security incident handling consists of several phases, among which digital forensic analysis has an irreplaceable place. Due to particular digital evidence being recorded at a specific time, timelines play an essential role in analyzing this digital evidence. One of the vital tasks of the digital forensic investigator is finding relevant records in this timeline. This operation is performed manually in most cases. This paper focuses on the possibilities of automatically identifying digital evidence pertinent to the case and proposes a model that identifies this digital evidence. For this purpose, we focus on Windows operating system and the NTFS file system and use outlier detection (Local Outlier Factor method). Collected digital evidence is preprocessed, transformed to binary values, and aggregated by file system inodes and names. Subsequently, we identify digital records (file inodes, file names) relevant to the case. This paper analyzes the combinations of attributes, aggregation functions, local outlier factor parameters, and their impact on the resulting selection of relevant file inodes and file names.Keywords
Funding Information
- Slovak Research and Development Agency (APVV-17-0561)
This publication has 12 references indexed in Scilit:
- Deep Learning Approaches for Anomaly and Intrusion Detection in Computer Network: A Review2021
- RDPOD: an unsupervised approach for outlier detectionNeural Computing and Applications, 2021
- A Review of Local Outlier Factor Algorithms for Outlier Detection in Big Data StreamsBig Data and Cognitive Computing, 2020
- The State of the Art in Machine Learning-Based Digital ForensicsSSRN Electronic Journal, 2020
- Sentiment Analysis in a Forensic Timeline With Deep LearningIEEE Access, 2020
- Outlier detection using isolation forest and local outlier factor2019
- Timeline2GUI: A Log2Timeline CSV parser and training scenariosDigital Investigation, 2019
- Graph clustering and anomaly detection of access control log for forensic purposesDigital Investigation, 2017
- CAT Detect (Computer Activity Timeline Detection): A tool for detecting inconsistency in computer activity timelinesDigital Investigation, 2011
- Time based data forensic and cross-reference analysis2011