Abstract
In digital forensics, user profiling aims to predict characteristics of the user from digital evidence extracted from digital devices (e.g. smartphone, laptop, tablet). Previous researches showed promising results, but there are limitations to apply practical investigations. The researches so far have focused only on specific applications, devices, or operating systems by analyzing the order of execution or volatile data such as network traffic and online content. This paper introduces a user profiling method, named Entity Profiling with Binary Predicates (EPBP) model, which analyzes non-volatile data remained on digital devices. The proposed model defines that a user has two properties: tendency and impact, which indicate patterns of application usage. Based on the attributes, the EPBP model generates users’ profiles and performs similarity analysis to differentiate between the users. We also present methods for clustering and anomaly detection through real case studies.
Original language | English |
---|---|
Article number | 114488 |
Journal | Expert Systems With Applications |
Volume | 168 |
DOIs | |
Publication status | Published - 2021 Apr 15 |
Keywords
- Anomaly detection
- Application usage
- Digital forensics
- User profiling
- User similarity
ASJC Scopus subject areas
- Engineering(all)
- Computer Science Applications
- Artificial Intelligence