Performance analysis of Bayesian networks and neural networks in classification of file system activities

Precise comprehension of a file system state at any given time is vital for performing digital forensic analyses. To uncover evidence of the digital crime, the logical representation of file system activities helps reconstruct post-event timeline of the unauthorized or malicious accesses made on a system. This paper describes a comparative performance analysis of the Bayesian networks and neural networks techniques to classify the state of file system activities in terms of execution of applications based on the pattern of manipulation of specific files during certain period of time. In particular, this paper discusses the construction of a Bayesian networks and neural networks from the predetermined knowledge of the manipulation of file system artifacts and their corresponding metadata information by a set of software applications. The variability amongst the execution patterns of various applications indicate that the Bayesian network-based model is a more appropriate tool as compared to neural networks because of its ability to learn and detect patterns even from an incomplete dataset. The focus of this paper is to highlight intrinsic significance of the learning approach of Bayesian network methodology in comparison to the techniques used for supervised learning in ordinary neural networks. The paper also highlights the efficacy of Bayesian network technique to proficiently handle large volumes of datasets. (C) 2012 Elsevier Ltd. All rights reserved.