Investigative Profiling with Computer Forensic Log Data and Association Rules

Authors:
Tamas Abraham;Olivier de Vel
Affiliations:
-;-
Venue:
ICDM '02 Proceedings of the 2002 IEEE International Conference on Data Mining
Year:
2002

Citing 0
Cited 6

Event sequence mining to develop profiles for computer forensic investigation purposes

ACSW Frontiers '06 Proceedings of the 2006 Australasian workshops on Grid computing and e-research - Volume 54
Automatically Acquiring Training Sets for Web Information Gathering

WI '06 Proceedings of the 2006 IEEE/WIC/ACM International Conference on Web Intelligence
Ontology based web mining for information gathering

WImBI'06 Proceedings of the 1st WICI international conference on Web intelligence meets brain informatics
From the Editorial Board: Research summary

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Development and Evaluation of a Dataset Generator Tool for Generating Synthetic Log Files Containing Computer Attack Signatures

International Journal of Ambient Computing and Intelligence
Measuring the forensic-ability of audit logs for nonrepudiation

Proceedings of the 2013 International Conference on Software Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

Investigative profiling is an important activity in computerforensics that can narrow the search for one or morecomputer perpetrators. Data mining is a technique that hasproduced good results in providing insight into large volumesof data. This paper describes how the associationrule data mining technique may be employed to generateprofiles from log data and the methodology used for the interpretationof the resulting rule sets. The process relies onbackground knowledge in the form of concept hierarchiesand beliefs, commonly available from, or attainable by, thecomputer forensic investigative team. Results obtained withthe profiling system has identified irregularities in computerlogs.