Facilitating forensic examinations of multi-user computer environments through session-to-session analysis of Internet history
| Autor: | C. S. Ierotheou, Diane Gan, David Gresty, George Loukas |
|---|---|
| Rok vydání: | 2016 |
| Předmět: |
Jaccard index
Computer science Digital forensics World wide web 02 engineering and technology Multi-user computer.software_genre Session (web analytics) 0202 electrical engineering electronic engineering information engineering Binary strings Multimedia business.industry Internet history analysis 020207 software engineering Computer Science Applications Pattern of life Medical Laboratory Technology Context analysis 020201 artificial intelligence & image processing The Internet business Session-to-session analysis Law computer Test data |
| Zdroj: | Digital Investigation. 16:S124-S133 |
| ISSN: | 1742-2876 |
| DOI: | 10.1016/j.diin.2016.01.015 |
| Popis: | This paper proposes a new approach to the forensic investigation of Internet history artefacts by aggregating the history from a recovered device into sessions and comparing those sessions to other sessions to determine whether they are one-time events or form a repetitive or habitual pattern. We describe two approaches for performing the session aggregation: fixed-length sessions and variable-length sessions. We also describe an approach for identifying repetitive pattern of life behaviour and show how such patterns can be extracted and represented as binary strings. Using the Jaccard similarity coefficient, a session-to-session comparison can be performed and the sessions can be analysed to determine to what extent a particular session is similar to any other session in the Internet history, and thus is highly likely to correspond to the same user. Experiments have been conducted using two sets of test data, where multiple users have access to the same computer. By identifying patterns of Internet usage that are unique to each user, our approach exhibits a high success rate in attributing particular sessions of the Internet history to the correct user. This can provide considerable help to a forensic investigator trying to establish which user was using the computer when a web-related crime was committed. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect