论文标题
自动伪像的相关性确定来自人工制品元数据和相关时间表事件
Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events
论文作者
论文摘要
在全世界的执法机构中，案例障碍，多年数字法证证据积压已经变得司空见惯。这是由于数量不断增长的案例，需要数字法医研究，再加上每个情况要处理的数据量的越来越多。利用先前处理的数字法医案例及其组件相关性分类可以促进培训基于人工智能的证据处理系统的机会。这些可以极大地帮助研究人员发现和优先级别的证据。本文介绍了一种档案伪像相关性确定的方法，该方法是基于集中式数字取证作为服务（DFAAS）范式的增长趋势的一种方法。这种方法使使用先前遇到的相关文件可以在调查中对新发现的文件进行分类。经过训练的模型可以在收购阶段（即上传到DFAAS系统中）在这些文件中检测这些文件。该技术使用每个文物的文件系统元数据和相关的时间表事件生成了文件相似性的相关性分数。提出的方法通过三种实验用法方案进行了验证。
Case-hindering, multi-year digital forensic evidence backlogs have become commonplace in law enforcement agencies throughout the world. This is due to an ever-growing number of cases requiring digital forensic investigation coupled with the growing volume of data to be processed per case. Leveraging previously processed digital forensic cases and their component artefact relevancy classifications can facilitate an opportunity for training automated artificial intelligence based evidence processing systems. These can significantly aid investigators in the discovery and prioritisation of evidence. This paper presents one approach for file artefact relevancy determination building on the growing trend towards a centralised, Digital Forensics as a Service (DFaaS) paradigm. This approach enables the use of previously encountered pertinent files to classify newly discovered files in an investigation. Trained models can aid in the detection of these files during the acquisition stage, i.e., during their upload to a DFaaS system. The technique generates a relevancy score for file similarity using each artefact's filesystem metadata and associated timeline events. The approach presented is validated against three experimental usage scenarios.
