Work

Temporal metadata analysis: A learning classifier system approach

Year: 2024

Type: article

Abstract: Digital forensics is a complex field that requires expert knowledge (EK) and specialized tools to collect, analyze, and report on digital evidence. Temporal metadata analysis is particularly challenging, requiring expert knowledge to understand and interpret underlying traces and associate them with their source. This paper introduces Digital Trace Inspector (DTI), a Learning Classifier System (LCS)-based decision support tool for temporal metadata analysis. DTI leverages a binary Michigan-style LCS to locate and group corroborating temporal digital traces of targeted user activity. Rules are built from expert-created atomics encoded as feature vectors using patterns defined in a structured EK rule framework. The system is evaluated on 10 scenarios of typical user behavior on a Windows 10 workstation. Results show that all models achieved perfect recall, had an average F1 score of 0.98, and required little training data. • Introduces a novel extraction and encoding method for machine learning tools. • Introduces a Learning Classifier System-based tool for temporal metadata analysis. • Interval and characteristic abstractions are effective in modeling temporal metadata. • Accurate and explainable models with small and imbalanced training datasets. • Learned rule population reduced solution for problem space by 99.95%.

Source: Forensic Science International Digital Investigation

DOI: 10.1016/j.fsidi.2024.301842

Authors: Michael C. Todd, Gilbert L. Peterson

Institution: U.S. Air Force Institute of Technology

Language: English

Topic: Digital and Cyber Forensics

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $3,340

Funder: U.S. Department of Defense