Skip to content

Quantifying the association between discrete event time series with applications to digital forensics

Journal: Journal of the Royal Statistical Society A
Published: 2020
Primary Author: Christopher Galbraith
Secondary Authors: Padhraic Smyth, Hal Stern
Research Area: Digital

We consider the problem of quantifying the degree of association between pairs of discrete event time series, with potential applications in forensic and cybersecurity settings. We focus in particular on the case where two associated event series exhibit temporal clustering such that the occurrence of one type of event at a particular time increases the likelihood that an event of the other type will also occur nearby in time. We pursue a non‐parametric approach to the problem and investigate various score functions to quantify association, including characteristics of marked point processes and summary statistics of interevent times. Two techniques are proposed for assessing the significance of the measured degree of association: a population‐based approach to calculating score‐based likelihood ratios when a sample from a relevant population is available, and a resampling approach to computing coincidental match probabilities when only a single pair of event series is available. The methods are applied to simulated data and to two real world data sets consisting of logs of computer activity and achieve accurate results across all data sets.

Related Resources

Tutorial on Likelihood Ratios with Applications in Digital Forensics

Tutorial on Likelihood Ratios with Applications in Digital Forensics

This CSAFE webinar was held on September 15, 2022. Presenters: Rachel Longjohn PhD Student – Department of Statistics, University of California, Irvine Dr. Padhraic Smyth Chancellor’s Professor – Departments of…
Likelihood Ratios for Categorical Evidence With Applications in Digital Evidence

Likelihood Ratios for Categorical Evidence With Applications in Digital Evidence

The following poster was presented at the 74th Annual Scientific Conference of the American Academy of Forensic Sciences (AAFS), Seattle, Washington, February 21-25, 2022.
Score-Based Likelihood Ratios for Camera Device Identification Using Cameras of the Same Brand for the Alternative Device Population

Score-Based Likelihood Ratios for Camera Device Identification Using Cameras of the Same Brand for the Alternative Device Population

Score-based likelihood ratios are a statistical method for quantifying the weight of evidence and have been used in many areas of forensics, including camera device identification1,2,3. Small sensor imperfections caused…
Forensic Analysis on Cryptocurrency Wallet Apps

Forensic Analysis on Cryptocurrency Wallet Apps

The following was presented at the 74th Annual Scientific Conference of the American Academy of Forensic Sciences (AAFS), Seattle, Washington, February 21-25, 2022.