Likelihood Ratios for Categorical Evidence with Applications to Digital Forensics

In forensic investigations, the goal of evidence evaluation is often to address source-/identity-based questions in which the evidence consists of two sets of observations: one from an unknown source tied to a crime and the other from a known source. A widely accepted statistical approach to this problem is to compute a likelihood ratio that measures the relative probability of the evidence assuming that the known source either did or did not also generate the unknown-source criminal data. In this work, we develop a Bayesian approach to computing the likelihood ratio when the evidence is categorical count data and show how the likelihood ratio can be expressed in closed form under our model. We also analyze the theoretical impact of the prior through its effect on the likelihood ratio, rather than through the more traditional lens of the effect on posterior inference. Our approach is motivated by comparing users’ behavioral patterns in digital forensics, where user-generated events belong to a set of categories of forensic interest. We illustrate the potential efficacy of our proposed method by presenting results from experiments using three real-world digital event datasets.