A Method for Locating Digital Evidences with Outlier Detection Using Support Vector Machine

Abstract

One of the biggest challenges facing digital investigators is the sheer volume of data that must be searched in locating the digital evidence. How to efficiently locate the evidence relating to the computer crime while maintaining accuracy is becoming a research focus. In this paper, we introduce a two-tier method to automate the process of locating the digital evidence, which first employ a one-class Support Vector Machine (SVM) outlier detector to filter out insignificant records for forensic investigators and then use a group of one-class SVM classifiers (trained with the expert knowledge or interested samples for an investigator based on a different feature vector) to further analyze the output of the outlier detector to improve the accuracy of investigation. The effectiveness of the proposed method for locating digital evidence is demonstrated using the public datasets: KDD Cup99 (Knowledge Discovery and Data-mining) intrusion detection dataset.