从伪像元数据和关联时间轴事件自动确定伪像相关性
Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events
摘要：
妨碍案件的、多年的数字取证证据积压在世界各地的执法机构中已司空见惯。这是由于需要数字取证调查的案件数量不断增加，加上每个案件需要处理的数据量不断增加。利用先前处理的数字取证案例及其组成人工制品相关性分类可以促进训练基于自动化人工智能的证据处理系统的机会。这些可以大大帮助调查人员发现和优先考虑证据。本文提出了一种基于集中式数字取证即服务（DFaaS）范式的日益增长的趋势的文件伪影相关性确定方法。这种方法允许使用以前遇到的相关文件来对调查中新发现的文件进行分类。经过训练的模型可以帮助在获取阶段检测这些文件，即，在上传到DFaaS系统的过程中。该技术使用每个人工制品的文件系统元数据和相关联的时间轴事件来生成文件相似性的相关性分数。对三个实验使用场景的方法进行了验证。
英文摘要：
Case-hindering, multi-year digital forensic evidence backlogs have become commonplace in law enforcement agencies throughout the world. This is due to an ever-growing number of cases requiring digital forensic investigation coupled with the growing volume of data to be processed per case. Leveraging previously processed digital forensic cases and their component artefact relevancy classifications can facilitate an opportunity for training automated artificial intelligence based evidence processing systems. These can significantly aid investigators in the discovery and prioritisation of evidence. This paper presents one approach for file artefact relevancy determination building on the growing trend towards a centralised, Digital Forensics as a Service (DFaaS) paradigm. This approach enables the use of previously encountered pertinent files to classify newly discovered files in an investigation. Trained models can aid in the detection of these files during the acquisition stage, i.e., during their upload to a DFaaS system. The technique generates a relevancy score for file similarity using each artefact's filesystem metadata and associated timeline events. The approach presented is validated against three experimental usage scenarios.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
