A natural human language framework for digital forensic readiness in the public cloud

Abstract

Currently, about half of all global enterprises are adopting and using some form of cloud computing services. In cloud computing, potential digital evidence is distributed across multiple isolated virtual machine instances. Investigating deleted or inactive virtual instances of a cloud is a challenge to digital forensics, and the traditional methods of digital forensics are inadequate to address such digital forensic investigation. Users of the public cloud (whether a potential victim of a cyberattack, a cybercriminal or a digital forensic investigator) inherently communicate using natural human language in the form of sentences and semantics in document messaging such as texts, emails or instant messages. Consequently, natural human language interaction provides a unique identifier for cloud users. This study leverages the natural human language as an identifier to develop a novel digital forensic readiness (DFR) framework for cloud computing to detect cybercrime. The DFR framework comprises the integration of natural language processing techniques in designing a process that mimics a near real-time approach towards cybercrime detection in a cloud environment. Natural language understanding techniques are used to analyse textdata of users in the public cloud and textdata of reported cybercrimes to develop a DFR framework. In the preliminary formation of the DFR framework, the output shows that cybercrime attacks that are in progress in the form of textdata such as online documents, instant messages or emails within an organizational cloud domain can be identified, and potentially investigated swiftly, using the unique signature of users as identifiers. When adopted, the proposed DFR framework can minimize the time lapses in incident identification and reduce the subsequent investigation time of cybercrimes in the public cloud domain.

An Assessment of methods and techniques used in Forensic Linguistics

“…The linguist by the use of this technique might not make psychological observations regarding the authors or their intentions, however, reliant on the features, in the text, they can also be able to illustrate the social origins of the authors or their background. The method has been used widely along with communications enhanced and mediated by computer and there has been several documented arenas of it being advantageous to the consequence of a case and the justice provision (Baror et al, 2021). Conclusions regarding the probable context of anonymous author is likely to ever be sufficiently certain to offer proves and evidence for usage of courtroom, however, as evidence by means of prior case work, they could be utilised to determine the case logics, identifying any flaws or wrong information being provided by suspects and enhancing the case proceedings (Phakiti et al, 2018).…”

“…Identification of speakers, which has been classified as the most major feature of forensic phonetics comprising comparisons and profiling of voices (Baror et al, 2021).…”

“…Relying on the lawful system, conversations on tapped telephones or interviews of police that are recorded could be utilised as proof if the suspect is not cooperating or if additional evidences are required or more significant material of speech is required. Subsequent to analysis that is completed, the conclusion could be reached that is pertinent to the question if the speech samples that is likened originate from the similar or from diverse individuals (Baror et al, 2021).…”

“…Level of performance of these system do not yet appears to warrant massive introduction in comparison to applications with low risk (Marfianto and Riadi, 2018). Conditions and situations typical of forensic background for instance difference in equipment of recording and channels of transmission, the existence of background noise and variation due to communicative context differences endure to pose major challenge in the field of forensic linguistics (Baror et al, 2021). Consequently, the influence of technology of automatic speaker recognition and related technologies has been comparatively uncertain and practice of forensic speaker identification stays massively dominated by the utilisation of broad variety of hugely subjective processes (Wright, 2017).…”

Realising a Push Button Modality for Video-Based Forensics

“…As a consequence, questions regarding media authenticity are of growing significance, particularly in litigation where important decisions might be based on the reliability of the digital evidence [6]. A proper chain of custody, as well as a chain of evidence are also required to ensure the repeatability and possible expert presentation of a digital artefact [6][7][8].…”