Quantifying the Association Between Discrete Event Time Series with Applications to Digital Forensics

Abstract

We consider the problem of quantifying the degree of association between pairs of discrete event time series, with potential applications in forensic and cybersecurity settings. We focus in particular on the case where two associated event series exhibit temporal clustering such that the occurrence of one type of event at a particular time increases the likelihood that an event of the other type will also occur nearby in time.We pursue a non-parametric approach to the problem and investigate various score functions to quantify association, including characteristics of marked point processes and summary statistics of interevent times. Two techniques are proposed for assessing the significance of the measured degree of association: a populationbased approach to calculating score-based likelihood ratios when a sample from a relevant population is available, and a resampling approach to computing coincidental match probabilities when only a single pair of event series is available. The methods are applied to simulated data and to two real world data sets consisting of logs of computer activity and achieve accurate results across all data sets.

DSF Core: Integrated Decision Support for Optimal Scheduling of Lifetime Extension Strategies for Industrial Equipment

“…Although there are several other stop types, they have not been modelled because they have been considered as non-controllable or of insignificant impact on the KPIs, and according to a preliminary statistical stop correlation analysis based on [ 78 ], there was no (reliable) conclusion about their dependence with the important failure types mentioned above. Thus, for simulation purposes, the production time is uniformly distributed outside intervals of important failures and application of strategies.…”

Likelihood ratios for changepoints in categorical event data with applications in digital forensics

“…Digital forensics is a branch of forensic science that deals with the gathering and examination of digital and multimedia evidence. An emerging area of interest in digital forensics focuses on the examination of user-generated event data resulting from actions taken on or with a digital device, such as web browsing and authentication data [1], geolocation data [2][3][4], or sensor-based health and activity data [5][6][7].…”

“…LRs have been widely applied in the context of DNA evidence [13], and there is ongoing research into constructing LR models for a wide variety of other evidence types [14][15][16][17][18][19][20]. For quantitative evaluations using user-generated digital event data, recent work has also adopted the LR framework [1][2][3]8].…”

Towards a Likelihood Ratio Approach for Bloodstain Pattern Analysis

“…A number of authors have advocated for the LR approach (Aitken and Taroni, 2004;Willis et al, 2015). Attempts have been made to apply the LR approach to many kinds of forensic evidence like DNA (Steele and Balding, 2014), latent prints (Neumann et al, 2012), digital (Galbraith and Smyth, 2017;Galbraith et al, 2020), firearms (Bunch and Wevers, 2013) and handwriting (Bozza et al, 2008;Marquis et al, 2011;Gaborini et al, 2017). We briefly explain the approach here.…”