Likelihood ratios for changepoints in categorical event data with applications in digital forensics

Area of Science:

• Digital Forensics
• Statistical Modeling
• Bayesian Inference

Background:

• Digital forensics often analyzes time-stamped user-generated event data.
• Distinguishing data from a single owner versus multiple users (e.g., hacked accounts) is crucial.
• Existing methods require a precise, known changepoint for likelihood ratio calculations.

Purpose of the Study:

• To develop a novel likelihood ratio model for digital forensics.
• To address the challenge of uncertainty in the exact time of device/account ownership change (changepoint).
• To utilize Bayesian techniques for an unknown changepoint likelihood ratio model.

Main Methods:

• Developed a Bayesian likelihood ratio model accommodating an unknown changepoint.
• Derived a closed-form, computationally straightforward expression for the likelihood ratio.
• Employed simulated changepoints with real-world datasets for evaluation.

Main Results:

• The unknown changepoint model demonstrated comparable performance to a known changepoint model with a perfectly specified changepoint.
• The proposed model significantly outperformed a known changepoint model with a misspecified changepoint.
• The results highlight the advantage of incorporating changepoint uncertainty.

Conclusions:

• The developed unknown changepoint likelihood ratio model is effective for digital forensics.
• This Bayesian approach offers a robust solution when the exact time of data origin is uncertain.
• The model provides improved accuracy and reliability in forensic investigations involving user-generated data.