AI-Based UFDR Report Analysis and Intelligent Digital Forensic Investigation Assistant using Explainable Machine Learning

Abstract

Mobile and application-derived artefacts are becoming more central to digital forensic investigations; however, they can be a diverse set of evidence in a UFDR which are hard to prioritize manually. Mobile and application derived-artifacts are becoming more important to digital forensic investigations, and can be a diverse set of evidence in a UFDR that is difficult to manually prioritize. In the paper, the authors propose an Artificial Intelligence-based UFDR report analysis and intelligent digital forensic investigation assistant to transform the extracted report information into a structured and explainable analysis flow. The prototype now supports reading reports in JSON, XML, CSV and ZIP formats, validates the uploaded report, calculates an integrity checksum (SHA-256), and stores proof of the integrity in SQLite. Twenty behavioral features are created in communication, temporal, browser, application, and file activity. The trained Random Forest (RF) classifier enables three-way classification, and a trained Isolation Forest (Anomaly scoring) is used. A suspicious detector based on the 4 parameters is set, and activates when late-night activity is detected, or when suspicious incoming/outgoing communication, suspicious text indicators or high anomaly scores are detected. The conditions are combined using UNION logic and deduplicated by evidence identifier to return suspicious and/or critical records to the investigators. Risk engine helps transform the model and indicator outputs are mapped to a 0-100 score, and with the help of SHAP Tree Explainer, it is possible to get feature contributions by the model and a human-readable “WHY?” explanation based on evidence. An evidence-based assistant retrieves case, analysis and explanation information from the database and provides a deterministic answer when the language-model service is not available. The accuracy of the test split was 93% and F1-score, recall and macro precision were all approximately 0.93 for the synthetic benchmark that was reproduced using the project. Suspicious-detector tests were also conducted successfully, with special emphasis on specific tests. This system instead of the automatic finding of criminal conduct presents a non-automatic triage system, explainability and a conversational workflow for forensic decision support.