Likelihood ratios for categorical count data with applications in digital forensics

Abstract

We consider the forensic context in which the goal is to assess whether two sets of observed data came from the same source or from different sources. In particular, we focus on the situation in which the evidence consists of two sets of categorical count data: a set of event counts from an unknown source tied to a crime and a set of event counts generated by a known source. Using a same-source versus different-source hypothesis framework, we develop an approach to calculating a likelihood ratio. Under our proposed model, the likelihood ratio can be calculated in closed form, and we use this to theoretically analyse how the likelihood ratio is affected by how much data is observed, the number of event types being considered, and the prior used in the Bayesian model. Our work is motivated in particular by user-generated event data in digital forensics, a context in which relatively few statistical methodologies have yet been developed to support quantitative analysis of event data after it is extracted from a device. We evaluate our proposed method through experiments using three real-world event datasets, representing a variety of event types that may arise in digital forensics. The results of the theoretical analyses and experiments with real-world datasets demonstrate that while this model is a useful starting point for the statistical forensic analysis of user-generated event data, more work is needed before it can be applied for practical use.

Likelihood ratios for changepoints in categorical event data with applications in digital forensics

“…In this section, we first define the LR framework in a general forensic context before moving on to the specific setup for our proposed model. We will primarily focus on outlining the unknown changepoint LR model at a high level and showing how it builds upon the known changepoint LR model for categorical counts [8,21]. We provide a more precise mathematical description of the statistical model and corresponding derivations in Appendix A.…”

“…shown in [8,21] for the known changepoint scenario, using the Bayesian approach, the LR can be expressed as a ratio of expressions:…”

“…such that the parameters sum to K, following the setup of the weighted prior distribution in [8]. We use a weighted version of the prior for the text data because there are several tokens, such as the period, which are so generally common in the English language that more overlap in their usage is to be expected.…”

“…We use a weighted version of the prior for the text data because there are several tokens, such as the period, which are so generally common in the English language that more overlap in their usage is to be expected. By indicating certain words as more commonly expected in the text, the model will require that we observe more substantial overlapping counts in these words in order for them to be indicative of style, and hence to have a strong impact on the likelihood ratio as discussed in [8].…”

“…LRs have been widely applied in the context of DNA evidence [13], and there is ongoing research into constructing LR models for a wide variety of other evidence types [14][15][16][17][18][19][20]. For quantitative evaluations using user-generated digital event data, recent work has also adopted the LR framework [1][2][3]8].…”