Specializing CRISP-DM for Evidence Mining

Abstract

Forensic analysis requires a keen detective mind, but the human mind has neither the abihty nor the time to process the millions of bytes on a typical computer hard disk. Digital forensic investigators need powerful tools that can automate many of the analysis tasks that are currently being performed manually. This paper argues that forensic analysis can greatly benefit from research in knowledge discovery and data mining, which has developed powerful automated techniques for analyzing massive quantities of data to discern novel, potentially useful patterns. We use the term "evidence mining" to refer to the apphcation of these techniques in the analysis phase of digital forensic investigations. This paper presents a novel approach involving the specialization of CRISP-DM, a cross-industry standard process for data mining, to CRISP-EM, an evidence mining methodology designed specifically for digital forensics. In addition to supporting forensic analysis, the CRISP-EM methodology off'ers a structured approach for defining the research gaps in evidence mining.

Applying Topic Modeling to Forensic Data

“…The value of the information obtained in digital investigations has been questioned by several researchers [1,11]. In particular, they argue that the analysis phase, where most of the actionable evidence is gathered, lacks sufficient definition and support in terms of principles, methods and tools [14,17]. Knowledge discovery and data mining (KDD) has the potential to enhance the analysis phase [14,17].…”

“…In particular, they argue that the analysis phase, where most of the actionable evidence is gathered, lacks sufficient definition and support in terms of principles, methods and tools [14,17]. Knowledge discovery and data mining (KDD) has the potential to enhance the analysis phase [14,17]. The use of KDD principles and tools in digital investigations is referred to as "evidence mining" [17].…”

“…Knowledge discovery and data mining (KDD) has the potential to enhance the analysis phase [14,17]. The use of KDD principles and tools in digital investigations is referred to as "evidence mining" [17].…”

“…Thus, latent evidence -evidence that exists but is not directly accessible to the investigator -will not be found. Evidence mining, on the other hand, uses KDD principles and techniques to uncover electronic artifacts that assist in developing crime scenarios [17]. These artifacts include known evidence as well as latent evidence.…”

“…CRISP-EM, a specialization of the CRISP-DM process [5], is intended to support evidence mining [17]. The work described in this paper falls within the scope of the data preparation phase of CRISP-EM ( Figure 1).…”