User profiling via application usage pattern on digital devices for digital forensics

Abstract

In digital forensics, user profiling aims to predict characteristics of the user from digital evidence extracted from digital devices (e.g. smartphone, laptop, tablet). Previous researches showed promising results, but there are limitations to apply practical investigations. The researches so far have focused only on specific applications, devices, or operating systems by analyzing the order of execution or volatile data such as network traffic and online content. This paper introduces a user profiling method, named Entity Profiling with Binary Predicates (EPBP) model, which analyzes non-volatile data remained on digital devices. The proposed model defines that a user has two properties: tendency and impact, which indicate patterns of application usage. Based on the attributes, the EPBP model generates users' profiles and performs similarity analysis to differentiate between the users. We also present methods for clustering and anomaly detection through real case studies.