Applications of Machine Learning in Cyber Forensics

Introduction

Cybercrime has drastically increased since the 1970s with the widespread use of technology that led to various criminal activities. This, in turn, emphasized the need for efficient investigations over the past few years. Cyber forensics, also termed as digital or computer forensics, turns around the scientific and authorized extraction of evidence in the digital form. This field examines, analyzes, and reports the digital evidence given cyber/digital criminal activity (Baggili, I., & Behzadan, V. 2019). In human life, digitization has become dominant, occupying most of the day-to-day activities, either in professional or personal life. As a result, people are in and around a device that leads to digitization in most of their routine work. For example, a smartphone can provide access to various sensitive data (e.g., transaction, email, and messages) that can provide user-related information and their social connectivity (Rohmeyer, P. 2010). Mainly, digitization evolves at the cost of financial frauds; Intellectual Property Rights (IPR) infringements, malware, and terrorist communication are among the few to show the originality of cybercrime and its behavior.

Cyber forensics needs a structured efficient mode of inquiry about forensic pieces of evidence found in the crime space (Atlam, H., Walters, R., & Wills, G. 2018). By 2025, the expected number of Internet of things (IoT) devices may reach 21.5 billion worldwide, increasing the amount of data to be handled. Thereby, increasing the possibilities of cybercrime in a huge scale and providing preventive measures pose a great challenge (Statista Research Department. 2016). The development of Internet and data communication technologies can provide space for intruders to inject security attacks, cybercrimes, and malware (Atlam, H. F., et. al. 2017). Malicious attacks in the networks are common, and hackers can intrude into the network, which can be identified with an effective cyber security mechanism with artificial intelligence (AI). So there is a need for data handling with huge IoT data and predictive intelligence with the help of AI (Atlam, H. F., & Wills, G. B. 2020).

In order to handle the analysis of large amounts of complex data for forensic purposes, investigators frequently handle the increased demand with less time and low-priced measures. This is the reason why AI is being used in the field of cyber forensics; besides, even many traditional investigators might argue that it is not an incomparable solution, as they agree that AI can help improve the battle against cybercrime (Karie, N. M., et. al. 2019).

This chapter proposes a suitable framework in which machine learning (ML) concepts and techniques are integrated with digital forensic activities (e.g., evidence collection, analysis, and correlation). In this framework, forensic export decides upon the prediction results of ML to move towards report generation.