Hudan Studiawan

Apple Health data provide critical forensic insights into a user's physical activities, exercise routines, sleep patterns, and biometrics. However, the complexity of its database schema and frequent iOS updates pose significant challenges for automated forensic analysis. This research develops and integrates custom plugins into the log2timeline Plaso framework to automate the extraction of Apple Health records. The developed parsers were tested across multiple iterations, specifically addressing the database reorganizations found in iOS 13.3.1, iOS 13.4.1, iOS 15.3.1, iOS 16.1.2, and iOS 17.3. Results demonstrate the developed plugins outperform iLEAPP (iOS Logs, Events, and Plist Parser) by successfully extracting Apple Health features that previously unrecoverable. The plugins successfully integrate disparate schema variations across multiple iOS versions into a unified timeline, reducing manual analysis effort. This study concludes that adaptive plugins is essential for maintaining forensic tool efficacy amidst rapid mobile iOS evolution, providing a robust solution for timeline‐based health data investigations.

Event reconstruction is a fundamental aspect of the investigative process in digital forensics. During this process, one systematically analyzes and organizes evidence to formulate a hypothesis regarding past events. The starting point is often the raw data from forensic timelines (e.g., a table including all parsed events), which may include millions of timeline entries. Various tools and techniques have been proposed to analyze these entries. However, the feasibility of applying process mining solutions remains unexplored. Process mining, with its ability to uncover patterns, deviations, and process flows from event data, can offer valuable insights into forensic event reconstruction. In this study, we explore the utilization of episode mining to generate case identifiers and provide event sequences, visualizations, and evaluation metrics from process models generated by process mining algorithms. As a result, we developed an open-source, web-based prototype application. Experiments and case studies conclude that the proposed method can reconstruct digital forensic events and provide intuitive results to forensic investigators.

Anomaly-based network intrusion detection systems (NIDSs) complement signature-based detection methods to identify unknown (zero-day) attacks. The integration of machine and deep learning enhanced the efficiency of such NIDSs. However, since anomaly-based NIDSs heavily depend on the quality of the training data, the presence of malicious traffic in the training set can significantly degrade the model’s performance. Purging the training data of such traffic is often impractical. This study investigates performance degradation caused by increasing amounts of malicious traffic in the training data. We introduced varying portions of malicious traffic into the training sets of machine and deep learning models to determine which approach is most resilient to unclean training data. Our experiments revealed that Autoencoders, using a byte frequency feature set, achieved the highest F2 score (0.8989), with only a minor decrease of 0.0009 when trained on the most contaminated dataset. This performance drop was the smallest compared to other algorithms tested, including an Isolation Forest, a Local Outlier Factor, a One-Class Support Vector Machine, and Long Short-Term Memory.

In recent years, drones have become ubiquitous across various industries, raising concerns about their potential malfunctions. Investigating such malfunctions requires effective forensic analysis techniques. The purpose of this research is to enhance Transformer architecture to address the specific challenge of analyzing drone malfunctions using log data. The proposed method, Transformer for Forensic (TransFor), uses positional encoding and embedding scaling to enhance the Transformer’s ability to interpret drone log data, using which we can identify the chronological sequence of events that led to malfunctions. As a result, the model can detect patterns that indicate various types of problems or malfunctions. Experimental evaluations have confirmed that the modified Transformers outperform existing models in identifying drone malfunctions with great accuracy. Because of its inherent strengths, including the focus on positional information, the TransFor is capable of being used in forensic analyses of drone malfunctions.