Journal
IEEE ACCESS
Volume 8, Issue -, Pages 60664-60675Publisher
IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC
DOI: 10.1109/ACCESS.2020.2983435
Keywords
Forensic timeline; deep learning; context attention; content attention; sentiment analysis; event logs
Categories
Funding
- Indonesia Lecturer Scholarship (BUDI) from the Indonesia Endowment Fund for Education (LPDP)
- Ministry of Finance
- Ministry of Research, Technology, and Higher Education of the Republic of Indonesia
Ask authors/readers for more resources
A forensic investigator creates a timeline from a forensic disk image after an occurrence of a security incident. This procedure aims to acquire the time for all events identified from the investigated artifacts. An investigator usually looks for events of interest by manually searching the timeline. One of the sources from which to build a timeline is log files, and these events are often found in log messages. In this paper, we propose a sentiment analysis technique to automatically extract events of interest from log messages in the forensic timeline. We use a deep learning technique with a context and content attention model to identify aspect terms and the corresponding sentiments in the forensic timeline. Terms with negative sentiments indicate events of interest and are highlighted in the timeline. Therefore, the investigator can quickly examine the events and other activities recorded within the surrounding time frame. Experimental results on four public forensic case studies show that the proposed method achieves 98.43% and 99.64% for the F1 score and accuracy, respectively.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available