A Multi-modal Approach Using Game Theory for Android Forensics Tool Selection

Abstract

In the field of digital forensics, specifically for android forensics, we have several tool options to use during the investigations for a given task. Investigators may prefer to utilize one tool over the others depending on reasons such as success of the tool for particular tasks and the execution time required to use the tool. It is also common that forensic tools do not have the same performance in different cases involving different tasks or devices. To overcome this problem a game theory based multi-modal approach for android forensics is proposed. The idea is to test and analyze 14 android forensics tools and generated a dataset for each tool based on the features and functionalities that it provides. Each dataset is given as input to Multi-arm bandit(MAB) algorithms to calculate rewards. Using the type of action and calculated rewards a decision tree will be generated. Siblings on the same level indicate that they provide a similar kind of action. Further game theory approaches will be applied to the siblings of the decision tree. Based on the obtained rewards, the payoff of each mixed strategy nash equilibrium can be calculated for sibling nodes w.r.t different game theory and the efficiency of the pair of tools can be determined. This will help in determining if a given android forensic tool should be selected or not for a particular forensic investigation.