Reasoning About Evidence Using Bayesian Networks

Abstract

There is an escalating perception in some quarters that the conclusions drawn from digital evidence are the subjective views of individuals and have limited scientific justification. This paper attempts to address this problem by presenting a formal model for reasoning about digital evidence. A Bayesian network is used to quantify the evidential strengths of hypotheses and, thus, enhance the reliability and traceability of the results produced by digital forensic investigations. The validity of the model is tested using a real court case. The test uses objective probability assignments obtained by aggregating the responses of experienced law enforcement agents and analysts. The results confirmed the guilty verdict in the court case with a probability value of 92.7%.

Evaluation of Evidence in Internet Auction Fraud Investigations

“…Specifically, if the LR value is relatively large (greater than 1,000) the search for the implied digital evidence should proceed. This would be followed by applying a cost-effective digital forensic investigation model [17] to identify the evidentiary traces and then applying the Bayesian network model [13] with the retrieved traces. On the other hand, if the LR value is found to be relatively small, the evidence does not strongly support the chosen hypotheses.…”

Relating Admissibility Standards for Digital Evidence to Attack Scenario Reconstruction

“…In order to facilitate the expression of opinions regarding the certainty of an assertion on the evidence credibility and weight, Bayesian network modeling is used to calculate the analysts' judgment on the certainty of evidence (Liu, Singhal, and Wijesekera, 2012;Keppens, Shen, and Schafer, 2005;Kwan, Chow, Law, and Lai, 2008). Besides, Weiss 2003 suggests using a 10-point scale of certainty based on legally defined standards of proof and compares "legal", "scientific" and "Bayesian" scales, which provides a more precise way to characterize a forensics analyst's judgment.…”

“…Similar work that uses Bayesian network modeling can be found in Kwan, Chow, Law, and Lai (2008), but the definition in Liu, Singhal, and Wijesekera (2013) uses the evidence attributes from Definition 1, and it calculates p(e) and p(h) as follows.…”

“…Also, in order to quantify the strengths of hypotheses that are based on the legal admissibility judgment of evidence, Kwan at el. proposed using a Bayesian belief network to analyze the evidence with respect to hypothetical scenarios, and thus, enhancing the credibility and traceability of the results produced by digital forensic investigations (Kwan, Chow, Law and Lai, 2008). The Bayes' theorem used for evidence analysis in Kwan is P(E|H)=P(E)P(H|E)/P(H), where P(E|H) is the conditional probability of evidence E based on hypothesis H; P(E) is the prior probability of evidence E; P(H|E) is posterior probability representing the probability that hypothesis H has actually occurred when E is detected; and P(H) is the prior probability of hypothesis H judged by investigators' background knowledge.…”

Sensitivity Analysis of Bayesian Networks Used in Forensic Investigations

“…Research on applying Bayesian networks to criminal investigations is on the rise [7][8][9]12]. The application of Bayes' theorem and graph theory provides a means to characterize the causal relationships among variables [16].…”