Computer forensics faces a range of challenges due to the widespread use of computing technologies. Examples include the increasing volume of data and devices that need to be analysed in any single case, differing platforms, use of encryption and new technology paradigms (such as cloud computing and the Internet of Things). Automation within forensic tools exists, but only to perform very simple tasks, such as data carving and file signature analysis. Investigators are responsible for undertaking the cognitively challenging and time-consuming process of identifying relevant artefacts. Due to the volume of cyber-dependent (e.g., malware and hacking) and cyber-enabled (e.g., fraud and online harassment) crimes, this results in a large backlog of cases. With the aim of speeding up the analysis process, this paper investigates the role that unsupervised pattern recognition can have in identifying notable artefacts. A study utilising the Self-Organising Map (SOM) to automatically cluster notable artefacts was devised using a series of four cases. Several SOMs were created - a File List SOM containing the metadata of files based upon the file system, and a series of application level SOMs based upon metadata extracted from files themselves (e.g., EXIF data extracted from JPEGs and email metadata extracted from email files). A total of 275 sets of experiments were conducted to determine the viability of clustering across a range of network configurations. The results reveal that more than 93.5% of notable artefacts were grouped within the rank-five clusters in all four cases. The best performance was achieved by using a 10ź×ź10 SOM where all notables were clustered in a single cell with only 1.6% of the non-notable artefacts (noise) being present, highlighting that SOM-based analysis does have the potential to cluster notable versus noise files to a degree that would significantly reduce the investigation time. Whilst clustering has proven to be successful, operationalizing it is still a challenge (for example, how to identify the cluster containing the largest proportion of notables within the case). The paper continues to propose a process that capitalises upon SOM and other parameters such as the timeline to identify notable artefacts whilst minimising noise files. Overall, based solely upon unsupervised learning, the approach is able to achieve a recall rate of up to 93%.
[1]
Wei Lai,et al.
Detecting Criminal Relationships through SOM Visual Analytics
,
2015,
2015 19th International Conference on Information Visualisation.
[2]
Teuvo Kohonen,et al.
The self-organizing map
,
1990,
Neurocomputing.
[3]
Nicole Beebe,et al.
Post-retrieval search hit clustering to improve information retrieval effectiveness: Two digital forensics case studies
,
2011,
Decis. Support Syst..
[4]
M S Olivier,et al.
The use of self-organising maps for anomalous behaviour detection in a digital investigation.
,
2006,
Forensic science international.
[5]
Eoghan Casey,et al.
Handbook of Digital Forensics and Investigation
,
2009
.
[6]
Eoghan Casey,et al.
The impact of full disk encryption on digital forensics
,
2008,
OPSR.
[7]
A. Nur Zincir-Heywood,et al.
Using self-organizing maps to build an attack map for forensic analysis
,
2006,
PST.
[8]
Nicole Beebe,et al.
Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results
,
2007,
Digit. Investig..
[9]
Simson L. Garfinkel,et al.
Digital forensics research: The next 10 years
,
2010,
Digit. Investig..
[10]
Richard Adderley,et al.
Data mining case study: modeling the behavior of offenders who commit serious sexual assaults
,
2001,
KDD '01.
[11]
Uwe Aickelin,et al.
Self-Organising Maps in Computer Security
,
2016,
ArXiv.
[12]
D Lawton,et al.
eDiscovery in digital forensic investigations
,
2014
.
[13]
Jan H. P. Eloff,et al.
Exploring Forensic Data with Self-Organizing Maps
,
2005,
IFIP Int. Conf. Digital Forensics.
[14]
Esteban J. Palomo,et al.
Visualisation of network forensics traffic data with a self-organising map for qualitative features
,
2011,
The 2011 International Joint Conference on Neural Networks.