Abstract:An issue that continues to impact digital forensics is the increasing volume of data and the growing number of devices. One proposed method to deal with the problem of “big digital forensic data”: the volume, variety, and velocity of digital forensic data, is to reduce the volume of data at either the collection stage or the processing stage. We have developed a novel approach which significantly improves on current practice, and in this paper we outline our data volume reduction process which focuses on imaging a selection of key files and data such as: registry, documents, spreadsheets, email, internet history, communications, logs, pictures, videos, and other relevant file types. When applied to test cases, a hundredfold reduction of original media volume was observed. When applied to real world cases of an Australian Law Enforcement Agency, the data volume further reduced to a small percentage of the original media volume, whilst retaining key evidential files and data. The reduction process was applied to a range of real world cases reviewed by experienced investigators and detectives and highlighted that evidential data was present in the data reduced forensic subset files. A data reduction approach is applicable in a range of areas, including: digital forensic triage, analysis, review, intelligence analysis, presentation, and archiving. In addition, the data reduction process outlined can be applied using common digital forensic hardware and software solutions available in appropriately equipped digital forensic labs without requiring additional purchase of software or hardware. The process can be applied to a wide variety of cases, such as terrorism and organised crime investigations, and the proposed data reduction process is intended to provide a capability to rapidly process data and gain an understanding of the information and/or locate key evidence or intelligence in a timely manner.

Technical Study of Reducing Redundant Data for Intrusion Detection and Intrusion Forensics

Study of Adaptive Intrusion Detection with Data Mining

Research on Data Mining-based Intrusion Detection in Real-time Environment

A Method to Automatically Filter Log Evidences for Intrusion Forensics

High Fidelity Data Reduction for Big Data Security Dependency Analyses.

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

Application and Performance Analysis of Data Preprocessing for Intrusion Detection System.

A Survey of Research On Intrusion Detection of Statistics Analysis Based on Network Traffic

Big forensic data reduction: digital forensic images and electronic evidence

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

An Intrusion Detection Model Based on Feature Reduction and Convolutional Neural Networks

Alert reduction for network intrusion detection

Analysis of Different Dimensionality Reduction Techniques and Machine Learning Algorithms for an Intrusion Detection System

Intrusion Detection System Based on RNN Classifier for Feature Reduction

Network Data Classification Mechanism for Intrusion Detection System

AudiTrim: A Real-time, General, Efficient, and Low-overhead Data Compaction System for Intrusion Detection

New Algorithm for Attribute Reduction Based on Intrusion Detection

Redesign and implementation of evaluation dataset for intrusion detection system

Anomaly Detection and Redundancy Elimination of Big Sensor Data in Internet of Things

Medical big data intrusion detection system based on virtual data analysis from assurance perspective

Research of Intrusion Detection System Dataset Evaluation