An official website of the United States government
The increasing prevalence of Internet of Things (IoT) devices has introduced significant challenges in digital forensic investigations, requiring new strategies for effective evidence prioritization and analysis. Traditional forensic methods struggle with data heterogeneity, volatility, and legal constraints, making IoT evidence collection complex and time-sensitive. This paper presents a weighted prioritization model (WPM) that ranks IoT devices based on six forensic criteria, enabling investigators to focus on highpriority evidence first, reducing data loss and optimizing forensic workflows. Through case studies in arson, homicide, and missing person investigations, we demonstrate how WPM enhances investigative decisionmaking and resource allocation in real-world forensic scenarios. The proposed framework offers a structured, scalable, and adaptable approach to IoT forensic investigations, improving efficiency, reliability, and legal compliance in digital evidence collection.
more »
« less
Building knowledge graphs of homicide investigation chronologies
Homicide investigations generate large and diverse data in the form of witness interview transcripts, physical evidence, photographs, DNA, etc. Homicide case chronologies are summaries of these data created by investigators that consist of short text-based entries documenting specific steps taken in the investigation. A chronology tracks the evolution of an investigation, including when and how persons involved and items of evidence became part of a case. In this article we discuss a framework for creating knowledge graphs of case chronologies that may aid investigators in analyzing homicide case data and also allow for post hoc analysis of the key features that determine whether a homicide is ultimately solved. Our method consists of 1) performing named entity recognition to determine witnesses, suspects, and detectives from chronology entries 2) using keyword expansion to identify documentary, physical, and forensic evidence in each entry and 3) linking entities and evidence to construct a homicide investigation knowledge graph. We compare the performance of several choices of methodologies for these sub-tasks using homicide investigation chronologies from Los Angeles, California. We then analyze the association between network statistics of the knowledge graphs and homicide solvability.
more »
« less
- Award ID(s):
- 1737585
- PAR ID:
- 10276739
- Date Published:
- Journal Name:
- IEEE International Conference on Data Mining Workshops
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Claydon, John A. (Ed.)Reef fishes support important fisheries throughout the Caribbean, but a combination of factors in the tropics makes otolith microstructure difficult to interpret for age estimation. Therefore, validation of ageing methods, via application of Δ 14 C is a major research priority. Utilizing known-age otolith material from north Caribbean fishes, we determined that a distinct regional Δ 14 C chronology exists, differing from coral-based chronologies compiled for ageing validation from a wide-ranging area of the Atlantic and from an otolith-based chronology from the Gulf of Mexico. Our north Caribbean Δ 14 C chronology established a decline series with narrow prediction intervals that proved successful in ageing validation of three economically important reef fish species. In examining why our north Caribbean Δ 14 C chronology differed from some of the coral-based Δ 14 C data reported from the region, we determined differences among study objectives and research design impact Δ 14 C temporal relationships. This resulted in establishing the first of three important considerations relevant to applying Δ 14 C chronologies for ageing validation: 1) evaluation of the applicability of original goal/objectives and study design of potential Δ 14 C reference studies. Next, we determined differences between our Δ 14 C chronology and those from Florida and the Gulf of Mexico were explained by differences in regional patterns of oceanic upwelling, resulting in the second consideration for future validation work: 2) evaluation of the applicability of Δ 14 C reference data to the region/location where fish samples were obtained. Lastly, we emphasize the application of our north Caribbean Δ 14 C chronology should be limited to ageing validation studies of fishes from this region known to inhabit shallow water coral habitat as juveniles. Thus, we note the final consideration to strengthen findings of future age validation studies: 3) use of Δ 14 C analysis for age validation should be limited to species whose juvenile habitat is known to reflect the regional Δ 14 C reference chronology.more » « less
-
Riedel, Sebastian; Choi, Eunsol; Vlachos, Andreas (Ed.)Recently there is an increasing scholarly interest in time-varying knowledge graphs, or temporal knowledge graphs (TKG). Previous research suggests diverse approaches to TKG reasoning that uses historical information. However, less attention has been given to the hierarchies within such information at different timestamps. Given that TKG is a sequence of knowledge graphs based on time, the chronology in the sequence derives hierarchies between the graphs. Furthermore, each knowledge graph has its hierarchical level which may differ from one another. To address these hierarchical characteristics in TKG, we propose HyperVC, which utilizes hyperbolic space that better encodes the hierarchies than Euclidean space. The chronological hierarchies between knowledge graphs at different timestamps are represented by embedding the knowledge graphs as vectors in a common hyperbolic space. Additionally, diverse hierarchical levels of knowledge graphs are represented by adjusting the curvatures of hyperbolic embeddings of their entities and relations. Experiments on four benchmark datasets show substantial improvements, especially on the datasets with higher hierarchical levels.more » « less
-
Abstract Knowledge Graphs organize and connect disparate data for integrating information in a user‐friendly interface for recommendations and applications. This analytical tool for supporting data interrogation has not been widely applied in agronomy. This article focuses on Knowledge Graph applicability and specifically the utility of the recently released Esri ArcGIS Knowledge platform for identifying system resilience using a community‐driven database (Forage Data Hub; 52,997 entries from 108 unique locations over 51 years) comprising legacy datasets encompassing multiple temporal and spatial scales. Overall, perennial systems had greater drought risk resilience estimates (DRRE) than annuals, with alfalfa (Medicago sativa) having a “very high” DRRE across ecoregions. Knowledge Graphs provided information on how geography and agronomic systems interact to impact resilience. Results can be used to design agricultural systems within specific geographic locations with greater resilience and stability in the face of a changing climate per geographic region.more » « less
-
Over the last decade, userland memory forensics techniques and algorithms have gained popularity among practitioners, as they have proven to be useful in real forensics and cybercrime investigations. These techniques analyze and recover objects and artifacts from process memory space that are of critical importance in investigations. Nonetheless, the major drawback of existing techniques is that they cannot determine the origin and context within which the recovered object exists without prior knowledge of the application logic. Thus, in this research, we present a solution to close the gap between application-specific and application-generic techniques. We introduce OAGen, a post-execution and app-agnostic semantic analysis approach designed to help investigators establish concrete evidence by identifying the provenance and relationships between in-memory objects in a process memory image. OAGen utilizes Points-to analysis to reconstruct a runtime’s object allocation network. The resulting graph is then fed as an input into our semantic analysis algorithms to determine objects’ origin, context, and scope in the network. The results of our experiments exhibit OAGen’s ability to effectively create an allocation network even for memory-intensive applications with thousands of objects, like Facebook. The performance evaluation of our approach across fourteen different Android apps shows OAGen can efficiently search and decode nodes, and identify their references with a modest throughput rate. Further practical application of OAGen demonstrated in two case studies shows that our approach can aid investigators in the recovery of deleted messages and the detection of malware functionality in post-execution program analysis.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Conference Paper:
- https://doi.org/10.1109/ICDMW51313.2020.00115
