SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Event reconstruction can be modelled using finite state machines [Gladyshev,
2005]. However in order to construct each model it is necessary to spend a
significant amount of time analysing the information to produce the states and
identify the relationships; it is also time consuming to evaluate files in this way.
However it is useful for identifying the order of events and can provide
assistance in identifying impossible sequences of events, therefore it is
necessary for an analyst to assess the potential reward from using such a
system against the high use of resources.
Neural networks have also been used for event reconstruction [Khan, 2007];
with a recurrent neural network achieving the highest accuracy of those tested.
However accuracy overall improved when the complexity of the data set was
increased; providing a more realistic model of the file types likely to be
encountered during an analysis. If the neural network is not presented with
realistic data, such as a cross section of files it is likely to encounter when used
on a suspects hard drive, then its ability to function on an actual hard drive may
not be as high as its ability during testing.
Zeitline is an event reconstruction method, which stores events in chronological
order to make it easier to identify patterns and group events together to create
larger more complex events. The ability of this package to model complicated
events makes it very useful to an analyst however it relies heavily on user
interaction and may therefore require too many resources for some
investigations.
2.3.4 Corrupting data
Corruption can be the result of deliberate manipulation of data by software,
such as the deletion of files, or the result of a virus; however the reliability of
Page 30