Applications and Challenges of Artificial Intelligence for Digital Forensics

By David Begg on April 16, 2024

Introduction

Artificial Intelligence (AI) is a rapidly growing technology with many potential applications in many different fields, and digital forensics is one of those fields. Here, AI has the potential to enable cybersecurity personnel and investigative bodies to collect and analyze evidence in ways and on scales that would be difficult if not impossible to do with current non-AI computer technology and human observation and action. However, implementation of AI into this field is not without its own set of unique challenges and considerations, and AI can also potentially be utilized by threat actors to facilitate their attacks. This paper will cover the potential uses of AI to aid in the process of digital forensics, the issues associated utilizing AI in digital forensics, and potential capabilities that AI can lend to threat actors.

AI applications in digital forensics

The potential value of AI as it relates to digital forensics lay in its ability to carry out analytical and observational tasks (e.g., pattern recognition, data collection, etc.), either in a way that augments the capabilities of humans in doing those tasks, or by doing similar tasks that are unable to be effectively carried out by humans manually, due to those tasks being too complex, time-consuming, or labor-intensive [1]. Big data associated with cybercrime investigation is one such situation in which AI can show its value; as the incidence of cybercrime increases, so does the amount, diversity, and rate of generation of data, and thus potential digital evidence, associated with those crimes [1,5]. Humans using standard analysis methods and software will be increasingly less able to keep pace with this massive body of data that is rapidly growing and diversifying, whereas an AI-enabled investigative framework has the potential to drastically reduce the amount of time and effort involved in such analyses by quickly filtering out irrelevant data and minimizing errors in collection and analysis, if configured appropriately [1,5].

AI can also aid in the automation of investigative work. Much of the time and effort spent by the currently manpower-starved body of digital forensic investigators is dedicated to text indexing, searching for artifacts, and other tasks associated with the burgeoning amount of evidence they must handle [3]. AI-enabled automation of those tasks would allow investigators to focus on other situations that demand human insight and effort [3], potentially reducing the amount of experienced and/or knowledgeable personnel required to work on one investigation and allowing them to work on others.

Challenges facing AI application in digital forensics

The implementation of AI in the field of digital forensics is not without issues, which arise from both technical and legal perspectives. General knowledge of AI and the processes underlying it are not widely spread throughout the body of law enforcement and legal personnel, and a lack of transparency has hindered the spread of this knowledge, leading to doubts about the admissibility of evidence gathered by or otherwise associated with AI [3]. Reproducibility has also been noted to be a concern, as a lack of predictability and thus repeatability of the results of AI programs has been noted [4]. AI models to aid incident response and other investigative tasks could also require a constant flow of large amounts data to properly train and maintain, and there is a lack of methods and standards by which valid and reliable data may be obtained; this could potentially lead to the models drawing erroneous conclusions [1]. These are only a few examples of the challenges that must be surmounted for effective application of AI in digital forensics.

AI use in cybercrime

Just as digital forensics personnel can use AI to help solve crimes, threat actors can use AI to carry out their attacks. Threat actors can use chatbots, AI-generated voices, or deepfakes to facilitate and augment techniques such as phishing and social engineering [2]. AI can be used make attempts at password cracking much easier to carry out through smarter and faster analysis of data that could potentially be used to figure out passwords (e.g., words and phrases suspected to be used in a password) [2]. AI systems themselves can also be the target of threat actors, who can confound the training of AI models by introducing bad data into their datasets [2].

Conclusion

AI represents both a great opportunity and a great threat to the field of digital forensics. The ways in which AI can be applied to aid digital forensics personnel are myriad and can enable those personnel to conduct tasks they might not be able to with contemporary methods. The challenges facing the application of AI are also numerous, spanning both the technical and the legal, and will need to be confronted for AI to be effectively utilized to aid investigators. Lastly, threat actors are just as capable of using AI for nefarious purposes by facilitating and augmenting their techniques or even targeting and disrupting AI systems directly. It is vital for the field of digital forensics to examine and utilize AI to keep up with the rapidly changing cyber landscape.

References

[1] Dunsin, D., Ghanem, M. C., Ouazzane, K., & Vassilev, V., “A comprehensive analysis of the role of artificial intelligence and machine learning in modern digital forensics and incident response,” 2024 https://www.researchgate.net/publication/378241312_A_comprehensive_analysis_of_ the_role_of_artificial_intelligence_and_machine_learning_in_modern_digital_forensics_and_ incident_response

[2] Jeong, D., “Artificial Intelligence Security Threat, Crime, and Forensics: Taxonomy and Open Issues,” 2020 https://ieeexplore.ieee.org/ielx7/6287639/8948470/09216065.pdf

[3] Murphy, J. P., ”Digital Forensic Investigations and Automated and Artificial Intelligence Technologies,” 2022 https://www.proquest.com/docview/2756725492?pq-origsite=gscholar&fromopenview=true&sourcetype=Dissertations%20&%20Theses

[4] Rawat, R., Oki, O. A., Chakrawarti, R. K., Adekunle, T. S., Lukose, J. M., & Ajagbe, S. A., “Autonomous Artificial Intelligence Systems for Fraud Detection and Forensics in Dark Web Environments,” 2023 https://www.informatica.si/index.php/informatica/article/view/4538

[5] Song, J., and Li, J., “A Framework for Digital Forensic Investigation of Big Data,” 2020 https://ieeexplore.ieee.org/document/9137498