An Embedded Bayesian Network Hidden Markov Model for Digital Forensics

In the paper we combine a Bayesian Network model for encoding forensic evidence during a given time interval with a Hidden Markov Model (EBN-HMM) for tracking and predicting the degree of criminal activity as it evolves over time. The model is evaluated with 500 randomly produced digital forensic scenarios and two specific forensic cases. The experimental results indicate that the model fits well with expert classification of forensic data. Such initial results point out the potential of such Dynamical Bayesian Network methods for the analysis of digital forensic data. 1 Forensics Evidence and Its Temporal Metadata Structure Digital forensic evidence corresponds to the dataset used to decide whether a crime has been committed and can provide a link between a crime and its victim or a crime and its perpetrator [1]. The evidence can be sourced from storage devices (disks, discs etc.), networks (e.g., packet data, routing tables, logs), embedded digital systems (mobile phones, PDAs), tele...

• Type: Journal
• Year: 2006
• Where: ISI
• Authors: Olivier Y. de Vel, Nianjun Liu, Terry Caelli, Tibério S. Caetano
• Keywords: Forensic, Forensic Data, Forensic Evidence, ISI 2006, Security Privacy