Bayesian Networks and Cyber-Crime Investigations
Richard E. Overill, Kam-Pui Chow · 2021
This chapter discusses the use of Bayesian networks (BNs) in analysing and understanding cyber-crimes from a digital forensics perspective. After initially providing some essential background material, the next section introduces Bayes theorem and the notion of conditional probability, followed by a description of the construction and operation of Bayesian networks. The following sections demonstrate the application of Bayesian networks to a number of actual cyber-crimes from the Hong Kong Special Administrative Region, illustrating the various quantitative measures, such as posterior probabilities and likelihood ratios,that can be obtained from them. The sensitivity of these measures to variations in the parameters associated with their respective Bayesian networks are also discussed, and their utility in aiding the construction of economically near-optimal triage schemes is emphasised in the context of developing cost-effective digital investigation schemas. In the final section, the contributions that Bayesian network analysis can offer to both the digital forensic investigation process and the juridical legal process are summarised. [180 words]