A hybrid deep learning technique based integrated multi-model data fusion for forensic investigation

Abstract

Digital evidence is an integral part of any trial. Data is critical facts, encrypted information that requires explanation in order to gain meaning and knowledge. The current process of digital forensic research cannot effectively address the various aspects of a complex infrastructure. Therefore, digital forensics requires the optimal processing of a complex infrastructure that differs from the current process and structure. For a long time, digital forensic research has been utilized to discuss these issues. In this research, we offer a forensic investigation hybrid deep learning approach based on integrated multi-model data fusion (HDL-DFI). First, we concentrate on digital evidence collection and management systems, which can be achieved by an integrated data fusion model with the help of an improved brain storm optimization (IBSO) algorithm. Here, we consider several multimedia data’s for evidence purposes, i.e. text, image, speech, physiological signals, and video. Then, we introduce a recurrent multiplicative neuron with a deep neural network (RM-DNN) for data de-duplication in evidence collection, which avoids repeated and redundant data. After that, we design a multistage dynamic neural network (MDNN) for sentimental analysis to decide what type of crime has transpired and classify the action on it. Finally, the accuracy, precision, recall, F1-score, G-mean, and area under the curve of our proposed HDL-DFI model implemented with the standard benchmark database and its fallouts are compared to current state-of-the-art replicas (AUC). The results of our experiments show that the computation time of the proposed model HDL-DFI is 20% and 25% lower than the previous model’s for uploading familiar and unfamiliar files, 22% and 29% lower for authentication generation, 23% and 31% lower for the index service test scenario, and 24.097% and 32.02% lower for familiarity checking.

Keywords

Digital forensics evidence collection evidence protection deep learning multi model fusion

1 Introduction

Digital forensics, a field that collects, analyses, and secures electronic data, may be used in court as evidence. In many circumstances, digital forensics may and does exist independently. Digital forensics investigations may be used for a variety of purposes [11]. In most criminal and civil courts, evidence is utilized to establish or deny accusations. Murder, theft, and violence against another individual are all considered criminal offences by the government. However, due of contractual differences between businesses, electronic discovery may be required in civil procedures [13, 14]. Encase is a digital data evidence collection system created by the American Guidance Cooperation and utilized by some domestic law enforcement organizations. This application may search the entire disc for a certain phrase and generate a list of the results (counting the file area, swap area, unallocated cluster, relaxed, and so on).

Because the digital data is so big, there is still a lot of hit data to sort through. Encase is unable to perform the following analysis. Data analysis and script programming are both time-consuming tasks that must be completed in order to satisfy the project’s needs. One of the first goals is to look into the income streams for MDMA providers on the crypto market. Before and after arrest, data on MDMA supply channels. The amount of crypto markets and vendor shops that continue to operate after many have been shut down by law enforcement is the third factor to be considered [2]. Because of these realities, unstructured data processing and analysis has to become a key advance in computer forensics. As a consequence, a software program was developed to assist investigators in finding and connecting the dots among the many pieces of evidence they gathered [7]. The “mass case information intelligence analyzing system,” detailed in this article and utilised in the collection of digital evidence, was developed in collaboration with the China Criminal Police College and Dalian University of Technology. One approach to do this is to make it easier to handle and analyse critical unstructured data.

The legitimacy of digital evidence is being called into doubt by more and more courts. Experts in the field must also have substantial technical skills, including knowledge of the procedures and standards often used to present prospective evidence in courts of law, in order for a judge or jury to think that the evidence offered is admissible. Judges should be able to convince forensic specialists that any possible digital evidence collected as part of the inquiry is real, trustworthy, and substantial. The digital forensic investigation technique [3]’s presentation phase is crucial. Investigators should also be conversant with a wide range of circumstances. This also shows that digital forensic investigations may be used in court [4] or other legal proceedings. Jurors will find it simpler to examine digital evidence if consistent digital forensics methodologies [8] are established [9]. Processes and standards are necessary for the advancement of digital forensics because they ensure that technologies are used appropriately and in accordance with digital forensics science. Because it is vital to analyze and comprehend data stored on critical digital devices while conducting DF investigations, BEA is used [13]. New frameworks based on BEA stages and existing DF process models are being developed in this project to provide more accurate information on what is required at each level. The Dubai Police Department analyses cyber stalking and the possession and transmission of indecent images of children based on 35 real-world digital criminal incidents (IIC). Following that, it’s utilized to investigate real-world digital criminal cases, including impersonation and defamation [8]. Scene analysis and physical evidence assessment are two common ways that criminal profiling is employed as an investigative technique. Based on prior offences and the actions of others, it’s simple to make assumptions about a suspected criminal’s personality and qualities [9].

A Major contribution to this proposed work is an enhancement in digital forensic investigation. A hybrid deep learning technique based integrated data fusion model is proposed in a digital forensic investigation (HDL-DFI). The main objective of the proposed HDL-DFI model is listed as follows:

To the best of our information, we are the first to address two main issues in digital forensic investigation are optimal evidence collection and evidence protection

To study and analyze the need for test datasets in the ground of digital forensics and discuss the details about integrated fusion data’s

To propose a hybrid deep learning technique to enhance the process of evidence collection and evidence protection in digital forensic investigation

A hybrid deep learning technique is used for sentimental analysis which classify what type of crime has occurred

The remainder of the paper is set up as follows: Section 2 announces current developments in the field of digital forensic investigation models. The issue description and scheme design of the proposed HDL-DFI model are explained in Section 3. Section 4 explains how the suggested HDL-DFI model works in conjunction with the mathematical model. Section 5 discusses the simulation findings and comparison analyses. Finally, Section 6 brings the paper to a close.

2 Related works

Many studies into digital evidence collecting and digital forensic inquiry have been conducted in recent years. Table 1 summarises and tabulates the literature in several aspects. The XeBag test has been detailed in video surveillance testing by Lim et al. [13]. An investigator may easily gather digital evidence using XeBag, including important court data from a variety of live organizations. XeBag is a certified container format that satisfies the generalization, scale, and integration criteria of a new digital certification container. To increase the spread of XeBag and to exploit their different data sources for forensics. XeBag/WinRAR and XML were employed. The Xbox Pack concept is useful since it can be used with a variety of extractor resources found in various file unit-based testing tools. Because XML still retains active data when extracted from a standard extractor and used as a public reader, a certain amount of security is provided because XeBag is kept independently.

Table 1
Summary of research gaps

Ref. Methodology Digital evidence ML/DL used Gaps

[13] XeBag- triage investigation Unified-videos × The preservation of integrity carries the danger of evidence being tainted by malicious actors.

[8] Semantic- digital forensic investigation Unified-images ✓ Sensor data might be exposed or vulnerable.

[9] Blockchain- digital forensic investigation Unified-texts ✓ Destroyed due to its fragile nature

[12] AutoTriage B-CoC- digital forensic investigation Unified-texts × Other aspects of computer forensics, outside the more commonplace ones, need to be studied, as they pointed out.

[6] Fintech- digital forensic investigation Unified-texts × The need to assure the verifiability of the trial outcomes

[13] Wildlife forensic evidence investigation Unified-images × Digital images not reveal details required for species-level identification

[14] LE chain- digital forensic investigation Unified-texts × Due to the high volume of redundant exchanges, it has a significant communication overhead.

[11] BCFL logging- digital forensic investigation Unified-texts × Log Evidence Seizure from Tagshop Cloud Blockchain Network

[10] Deep learning digital forensic investigation Unified-texts ✓ Affect by complex issue such as voluminous intricate legal, organizational, and technical defies

[24] CFIM digital forensic investigation Unified-texts × It led to increasing backlogs of evidence awaiting analysis

Ref.	Methodology	Digital evidence	ML/DL used	Gaps
[13]	XeBag- triage investigation	Unified-videos	×	The preservation of integrity carries the danger of evidence being tainted by malicious actors.
[8]	Semantic- digital forensic investigation	Unified-images	✓	Sensor data might be exposed or vulnerable.
[9]	Blockchain- digital forensic investigation	Unified-texts	✓	Destroyed due to its fragile nature
[12]	AutoTriage B-CoC- digital forensic investigation	Unified-texts	×	Other aspects of computer forensics, outside the more commonplace ones, need to be studied, as they pointed out.
[6]	Fintech- digital forensic investigation	Unified-texts	×	The need to assure the verifiability of the trial outcomes
[13]	Wildlife forensic evidence investigation	Unified-images	×	Digital images not reveal details required for species-level identification
[14]	LE chain- digital forensic investigation	Unified-texts	×	Due to the high volume of redundant exchanges, it has a significant communication overhead.
[11]	BCFL logging- digital forensic investigation	Unified-texts	×	Log Evidence Seizure from Tagshop Cloud Blockchain Network
[10]	Deep learning digital forensic investigation	Unified-texts	✓	Affect by complex issue such as voluminous intricate legal, organizational, and technical defies
[24]	CFIM digital forensic investigation	Unified-texts	×	It led to increasing backlogs of evidence awaiting analysis

The semantic network developed by Amato et al. [8] is an extensible algorithm that uses word processing methods to communicate concepts about a certain area in a consistent and systematic manner. Computer forensics is used to tackle domain extraction and extraction problems, as well as to increase the relevancy of the resources being assembled. For building linkages between domain organizations, this technique gives advantages, reasoning, and inference. Ryu et al. [9] have proposed a blockchain-based digital trial architecture for IoT contexts. All communication between IoT devices is stored as a company on a blockchain in a particular framework, making the current security network method simpler and more resilient. While retaining decentralized integrity, blockchain technology protects the accuracy and security of the data to be analysed. For data integrity protection, blockchain technology is the safest and most secure solution available. Jung et al. [12] presented an AutoTriage B-CoC model that allows for autonomous dredging collecting and blockchain uploads. Without human interaction, the highest accuracy and completeness of digital evidence may be accomplished. Experiments reveal that by simply inputting two key variables, Case-ID and Evidence-ID, a visual examiner can manage the protection and preservation of digital sources. The precise design of the tasks associated with the four phases, namely testing, documentation, blockchain, and reporting, is also a useful reference for practical use. Nikkel [6] suggested a digital forensics (Fintech) segment that would include financial technology. Fintech fees, financial transactions, and other financial transactions are all familiar to the Digital Transformation Society. Financial technology are used and abused by criminals for underground fraud, robbery, money laundering, and other financial operations. FinTech and digital payment process investigations should be considered technical subsets of digital forensics. Because certain species are tightly protected and others are traded legitimately, Trail [13] recommended taxonomic identification of animal items to assess if a crime has occurred. Hence, the animal items may be subject to customs clearance or other regulations, this identification must frequently be completed swiftly.

Providing trained specialists with digital photographs is a highly efficient technique to get a temporary identification in a timely manner. These picture IDs provide a probable justification for catching a suspect species of animal, which will be then sent to be confirmed and identified in person. Photo labels may also help to speed up lawful commerce by ensuring that animal items do not come from endangered species. The legal resource management software (LEChain) created by Li et al. [14] regulates the whole flow of resources across all court documents and to improves access to evidence during court hearings and jury voting. To safeguard the anonymity of witnesses and to identify them anonymously, they utilize brief and regular signatures. Then, for test access, we utilize a micro access control based on encrypted text policy attribute encryption. A secure voting system that uses the federal blockchain to record resource transactions and safeguard juror confidentiality. Awusondavid et al. [11] used Blockchain distributed ledger technology (DLT) to built and deploy BCFLs, which are transaction records. Smart contracts on the blockchain are used to ensure record integrity and create a transparent network. Check all transaction records and make sure they aren’t tampered with. Compliance with the BCFL and the EU’s Public Data Protection Regulations will be bolstered.

Bhardwaj et al. [10] suggested a crypto-proof security and resource-collection model for detecting malicious software assaults, safeguarding resources, and classifying network traffic data as harmful or malicious. It effectively saves and protects the saved digital materials. Using in-depth learning and machine learning classifiers, the malware software harvests transport information. N-depth training has been proven in several studies to successfully assist in the processing of massive data sets. Hemdan et al. [24] have proposed a cloud forensics investigation model (CFIM) for investigating and investigating cloud crimes in a timely manner. When executing digital forensics on a cloud website using a forensic server, the organization supports the notion of forensics as a service, which provides a number of advantages. This architecture enables you to trace dangerous users in the cloud, repair virtual computers for future usage, and assist and ease the cloud’s digital search process. The core concept is to film a virtual computer that can monitor, detect and record its own actions. Investigators and researchers may use CFIM to get digital resources concerning suspected VMs by downloading journal files and associated information.

3 Problem statement and system design

3.1 Problem statement

Recently, we have proposed a digital proof collective model for digital evidence investigation using integrated data models are text, audio and video [1]. We recommend a live data collection process for the digital resource collection process. Virtual evidence is obtained and reconstructed by researching and processing outdated and unskilled evidence. This method focuses on how a powerful computer and an analyzer may assist in the analysis and exploration of virtual resources. An e-discovery technique is employed to secure and evaluate virtual. For the defence and analysis of virtual evidence, an effective mechanism of disseminating virtual suggestions among the general public and the forensic section must be devised. This communication system defends against assaults by mid-humans. To avoid a successful duplicate of the data collection, divide the number of users who shared the same data by the number of uses. It may or may not be known when numerous users send data. By lowering storage requirements, these solutions enhance computer and data storage. The effectiveness of forensics depends on resource conservation. Security methods nowadays are built on a federal storage system with third parties, which always leads to a slew of issues [1, 24]. Strict security standards are usually required in centralized structures [9]. Intruding into a centralized storage terminal might result in major problems like data loss and corruption. The integrated system, like the present digital forensic system, is readily undermined in terms of openness and trustworthiness. People continue to have doubts about service dependability [6, 10-13]. Furthermore, various plans have different manufacturers and service providers, necessitating the need for a unified digital forensic system.

Evidence data needs to be checked for verification, but creating them is not an easy task. A poorly structured and documented test database undermines any test it uses and undermines the reliability of any test result [1]. In principle, this section should help those who do exactly that, without wasting resources, considering the time, effort, and knowledge required to set up a database. However, there are currently some criteria and best practices for creating databases in digital forensics. The current process of digital research cannot effectively address the various aspects of a complex infrastructure. Therefore, digital forensics and digital forensics [10, 13] require the optimal processing of a complex infrastructure that differs from the current process and structure. Digital forensic research has long been used to discourse on these subjects.

We checked the basic compatibility with recent technologies implemented in existing and still needed a lot of improvement, so by using the proposed HDL-DFI model, we also addressed the current forensic changes, which will be used in current trends based on data collection, data deduplication and the type of crime committed. In this paper, a hybrid deep learning technique based on an integrated fused data model is proposed for digital forensic investigation (HDL-DFI). The main contributions of the proposed HDL-DFI model are given as follows:

First, we concentrate on digital evidence collection and management systems which can be achieved by an integrated data fusion model with the help of improved brain storm optimization (IBSO) algorithm. IBSO is a bio-inspired algorithm [32] which provides an optimal solution for multi-objective problems. Here; we consider several multimedia data’s for evidence purposes, i.e. text, image, speech, physiological signals, and video [32].

Then, we introduce a recurrent multiplicative neuron with a deep neural network (RM-DNN) for data de-duplication in evidence collection. The main objective of RM-DNN based de-duplication is to avoid repeated and redundant data’s.

After that, we designed a novel multistage dynamic neural network (MDNN) for sentimental analysis that can be used to determine what type of criminality has happened and classify the action on it.

Finally, the simulation results of our proposed HDL-DFI model are compared to the current state-of-the-art models in terms of accuracy, recall, precision, f-measure, detection rate, and false alarm rate using the standard benchmark database.

3.2 System design of proposed HDL-DFI model

This section illustrates how the HDL-DFI model functions. While data and semantics are essential challenges in structured and unstructured data, big data analysis plays a vital part in digital evidence gathering and management systems. Big data that has been acquired digitally has been converted into a number of different technologies. We used the multi-model data fusion throughout the data management phase to lessen the complexity of the data dimensionality issue. The forensic section may carefully monitor and take fast action if the complainant produces substantial criminal evidence. For multi-model data fusion, we used improved brain storm optimization (IBSO) technique. After that, we used the RM-DNN approach to calculate repeated data in the data de-duplication phase. Multiple people may exchange digital resources concerning criminal activity, such as audio, video, and text chats. Finally, the emotive analysis is performed on the multi-model digital evidence to categorize the criminal acts. The suggested HDL-DFI model’s system architecture is shown in Fig. 1.

Fig. 1

System design of proposed HDL-DFI model.

4 Proposed methodology

THE HDL-DFI framework, which I proposed in my research and which consists of three stages, is discussed in this section. Digital forensic research cannot address complicated infrastructure adequately. It is difficult to preserve digital evidence, such as gathering data and minimizing duplication, and reporting evidence to the court. Digital forensics has long been used to examine these challenges. We offer a forensic hybrid deep learning approach based on multi-model data fusion (HDL-DFI).

First, we focus on digital evidence collection and management systems using an integrated data fusion model and an improved IBSO algorithm. Prior to moving on to the IBSO algorithm, the focus of this study was on gathering and managing digital evidence. The bio-inspired algorithm IBSO gives an optimal solution for multi-objective problems. Evidence can be in the form of text, images, sounds, physiological indications, and video.

Then, we use a recurrent multiplicative neuron with a deep neural network (RM-DNN) to get rid of repeated and redundant data.

Finally, we developed a multistage dynamic neural network (MDNN) for sentimental analysis to classify the crime. Preventative measures are grouped into categories according to the nature and severity of the crime. A common benchmark database is used to evaluate HDL-accuracy, DFI’s precision, recall, F-measures, and false alarm rates in comparison to existing models.

4.1 Digital evidence collection and management system

The integrated fusion model works as follows: if a user wants to upload virtual proof, it can be used for live data collection and filling by registering seven W’s basic questionnaires about the crime. Multimodal data is any kind of data that includes text, images, speech, video, numbers, graphs, physical signals, time, relationships, and groups.

Using our proposed model, anyone who has seen or heard evidence of a real crime based on a conversation can send it to the cyber forensics department. Once the data can be uploaded through registration to a cloud database using a standard resource connection and the proof can be put into a category based on where it was submitted, the IBSO will be able to solve multi-objective problems in the best way. Here, we look at different kinds of multimedia data, such as text, images, speech, psychological signals, and video that can be used as evidence.

Specifically, for the purpose of multi-modal data fusion, Improved Brain Storm optimization (IBSO) can be utilized to improve digital evidence collection and management systems. The brainstorm principle is inspired by the brain storm optimization (BSO) approach as a widely used tool to enhance creativity in companies that is widely recognized as a way to promote creative thinking. A practical solution instead of a solution reflects the concept of BSO. Follows the rules of group transfer of BSO concepts and uses clustering, modification, and operator work.

In this paper, we extend the BSO behavior as improved BSO called (IBSO) for digital evidence collection and management systems, especially for multi-model data fusion. In IBSO practice, n ideas begin at the approximate solution location and are then assessed based on their workout function. The following M cluster centre points are chosen at random and begin as n thoughts, where M is less than n. IPSO picks one or two clusters of q-One probability throughout the formation procedure. After that, a random notion with the chance of q-two centres was chosen based on the selection of one or two clusters, a cluster centre or q-one-center. The following is an example of a function.

$\begin{matrix} Yselect = \\ {\begin{matrix} Y_{j} & one cluster \\ rand * Y_{i 1} + (1 - rand) * Y_{i 2} & two cluster \end{matrix} \end{matrix}$ (1) Rand is a number that ranges from 0 to 1. The chosen notion (s) will be updated after one or two picks. ${Ynew = Yselect + ξ x normrnd (0, 1)$ (2) Where, normrnd is a Gaussion random value with an average of 0, and variations 1 and ξ are a control factor that reduces the integration rate during evolution, which can be expressed as such. $ξ = rand x \log sig [\frac{0.5 x max_iter - cur_iter}{k}]$ (3)

The maximum and current number of iterations are represented by the Rand value, which ranges from 0 to 1, respectively. K is a preset parameter that changes the logging function’s slope. A freshly developed thought is valued, and if the exercise value is higher than the present idea, the old one is replaced. For optimum results, the IBSO algorithm should employ both global and local search location information for solutions identified thus far. Local search solutions enhance information exploitation, while global search information leads to the exploration of areas of trust. In addition, the Multiple Model Differential Assessment (MMDE) Strategy Mutation and Shortcut Plan are successfully integrated into IBSO.

The main reason for integrating a different evolutionary strategy into the IBSO is that it can use the DE based primarily on distance and directional information and should not be biased against pre-defined guidelines. X_i created a new concept, combining all existing ideas according to Y_j into two existing random concepts, Y_r1 and Y_r2 $Xj = Yj + rand x (Yr 1 - Yr 2)$ (4) Rand is a random number ranging from 0 to 1, while R1 and R2 are random integers ranging from 1 to n. If the concept chosen based on the p-one and (1, p-one-center) probability is natural in the cluster, we will enable the concept to the explored from two randomly varied interpretations while generating a PSO operator. The basic principle of the MMDE operator is as follows: $Ynew = Ycenter + f (Yr 1 - Yr 2)$ (5)

Where, f is the mutation scaling factor that influences the difference between two ideas, and R1 and R2 are chosen at random from the cluster by opposite integers. By shifting competing vectors and enhancing demographic variety, the crossover feature is employed to produce novel solutions. We will enable you to investigate this notion while generating a PSO operator if two of the two clusters are common, based on the probability of the specified concepts (1, p-one) (1, p-2 centers). The value of the difference between the best idea in each cluster and two common concepts in two randomly chosen clusters. Is defined as the operator of two common notions’ distinct development $Ynew = GobalIdea + f (Yr 1 - Yr 2)$ (6)

Where, f is the mutation mounting factor, Gobal Idea is the best idea in all clusters, Y_r1 and Y_r2 represent the ordinary idea of cluster 1 and cluster 2. To make new solutions, utilize the shortcut function. First, look at the configuration component. It retains approximately 1 for nearly half a generation before becoming 0. This strategy of balancing research and exploitation over search generations may also be used with this method of step size management. It only works at very short intervals, however.

The dynamic mutation function is described as follows $ξ = rand x exp (1 - \frac{\max_iter}{\max_iter - cur_iter})$ (7)

Rand is a random value from 0 to 1. The maximum frequency and current frequency indicate the maximum number of repetitions and the number of current repetitions, respectively. The working function of proposed IBSO algorithm is given in Algorithm 1.

Algorithm 1 Multi-Model fusion using IBSO algorithm

Input:	features from text, audio, image, video and physiological signals
Output:	fused feature data
1.	arbitrarily initialize in ideas and appraise their fitness
2.	modify m cluster centers (M < n)
3.	while (stopping condition not met)
4.	cluster n thoughts into m clusters
5.	for i = 1 to n
6.	create Y_new1 using Y_new according
	Ynew = GobalIdea + f * (Yr1 - Yr2)
7.	accept Y_new1 if f(Y_new1) is better than f(Y_j)
8.	end while
9.	End

4.2 Data de-duplication process

After data fusion, we need to remove unwanted and repeated data’s from the given set. Here, we proposed a recurrent multiplicative neuron with a deep neural network (RM-DNN) technique for the de-duplication process. Digital evidence to protect human rights and prevent crime. The integration of digital evidence protection with the integration of the template model and the general subdivision of digital evidence is concerned, and the collection, analysis, and security model of digital evidence is implemented. The ultimate goal is to store multimedia data in a research model based on effective automated classification and duplication techniques. N should be the number of research samples. First, the RM-DNN input number is calculated, which includes the values q and p. The outcomes of the particular RM-DNN model may then be determined using these values of q and p.

Fist, we prepare loop counter K (K = 0). Upsurges K by1 (K = K+1). Calculations for K^th learning example are achieved. RM-DNN has only one hidden layer neuron, which we consider. The inputs of RM-DNN are. Y_s - 1, Y_s - 2, . . . Y_s - p, E_s - 1, E_s - 2, . . . . E_s - p. Neuron activation value is expressed as a net and is derived from the development of inputs to the RM-DNN by consistent weights. When K = 1, E_s - 1, E_s - 2, . . . . E_s - pare taken as 0 since the output of RM-DNN has not been considered yet. When K = 2, E_s - 1, can be considered. E_s - 1, equals to (desired_s - output_s) since the output of RM-DNN for the first scholarship sample was found. However, E_s - 2, . . . . E_s - p, are taken as 0. In a similar way, last p-K terms of E_s - 1, E_s - 2, . . . . E_s - p will be taken as 0 for K ≤ p. if K > p then, each E_s - j (j = 1, 2, . . . p) can be calculated. Let ZY_j and aY_j (j = 1, 2, . . . p) be weights, which connect Y_s - 1, Y_s - 2, . . . Y_s - p, input to the neuron and, the connected bias values, respectively. Let Ze_j and ae_j (j = 1, 2, . . . p) be weights which connect E_s - 1, E_s - 2, . . . . E_s - p inputs to the neuron and the connected bias values, correspondingly. Thus, for K-th learning sample, beginning value of the neuron net_k can be intended as, $ZYj x Yt - j + aYj = \prod_{i = 1}^{p} (z e_{i} x E_{s - i} + a e_{i})$ (8) Using the net (k) obtained in previous step and, the f function, calculate the RM-DNN output value as follows: $outputs = F (netk) = \frac{1}{1 + exp (- netk)}$ (9) Then, calculate error E_s based on change between the gained output value, and anticipated value by using the formula assumed as follows: $Es = desireds - outputs$ (10)

RM-DNN will utilise the value of Es worth as an input for the next training sample. If KN, go back to the previous step. Otherwise, the algorithm should be terminated. To train the suggested RM-DNN model, we use photon swarm optimization (PSO). The PSO approach has produced superior results in many applications than previously established methods, such as the Newton method, which needs gradient design and derivatives. When the derivative is very difficult to compute, PSO may provide excellent results. As a result, in recent years, this optimization strategy has received a lot of attention. PSO is used to train the proposed model since RM-DNN model derivatives are difficult to come by. In the PSO algorithm, positions of a photon are weights of proposed RM-DNN model. Hence, a photon has 2 (q + p) positions. Positions of each K^th (K = 1, 2,.. qN) particles’ positions and velocities are randomly single-minded and kept in vectors Y_K and U_K given as follows: $Yk = {yk 1, yk 2 \dots ykx} k = 1, 2, \dots qN$ (11) $Uk = {uk 1, uk 2 \dots ukx} k = 1, 2, \dots qN$ (12) where $y_{j}^{K}$ (j = 1, 2, . . . c) indicates the j state of the K-th particles. qN and c represent the number of particles in mass and phases, respectively. The initial state and velocity of each particle in the cluster are calculated by the uniform distributions (0, 1) and (-uM, uM), respectively. The parameters of the PSO are defined as follows: In the first step, the parameters to be processed by the PSO algorithm are defined. These parameters and qN, uM, d₁ _j, d_1f, d₂ _j, d_2f, z₁, and z₂. Let d₁ and d₂ be the cognitive and social coefficients w and the parameter of inertia, respectively. Possible values are (d_1f –d₁ _j), (d_2f –d₂ _j), and (z₂ –z₁) the spaces containing d₁, d₂, and z, respectively. The following formulae are used to determine these parameters in each iteration:

d 1 = (d 1 f - d 1 j) \frac{s}{MA X_{s}} + d 1 j

(13)

ds = (d 2 f - d 2 j) \frac{s}{MA X_{s}} + d 2 j

(14)

z 1 = (z 2 - z 1) \frac{MA X_{s} - s}{MA X_{s}} + z 1

(15)

Algorithm 2 Data de-duplication using RM-DNN technique

Input:	fused features
Output:	remove duplicate from fused features
1.	Initialize the parameters
2.	Calculate error E_s
	Es = desireds - outputs
3.	At each iteration, these parameters are calculated
	$d 1 = (d 1 f - d 1 j) \frac{s}{MA X_{s}} + d 1 j$
4.	Update the RM-DNN values
5.	If rand i = 0
6.	parameters of PSO
	$z 1 = (z 2 - z 1) \frac{MA X_{s} - s}{MA X_{s}} + z 1$
7.	mse given in below is used as evaluation function
	$mse = \frac{1}{N} \sum_{s = 1}^{N} {(desire d_{s} - outpu t_{s})}^{2}$
8.	best evaluation function value
	Hbest ={ qh, 1, qh, 2, … qh, c }
9.	End

The values of the estimation function of each particle are calculated using the average square error (mse) below. $mse = \frac{1}{N} \sum_{s = 1}^{N} {(desire d_{s} - outpu t_{s})}^{2}$ (16) The number of workout models in N. The estimated performance values determined in the preceding state define qbest K (K = 1, 2, . . . qN) and Hbest. Hbest is the best particle with the highest rated operating value ever identified, whereas qbestk is the vector that has the best individual performance levels for K-th particles. $qbestk = {qk 1, qk 2, \dots qkx} k = 1, 2, \dots qN$ (17) $Hbest = {qh 1, qh 2, \dots qhc} c = 1, 2, \dots qN$ (18) The updated values of the cognitive coefficient d₁, the social coefficient d₂ and the reaction parameter z are calculated using the given formulas (13)-(15). Calculates new levels and speed values. The new values of each particle’s position and velocity are calculated using formulas (19) and (20). The method advances to step 3 when the maximum number of iterations is achieved; otherwise, it advances to the next step:

$\begin{matrix} u_{i, c}^{s + 1} = & [{zu}_{j, c}^{s} + d 1 rand 1 (qj, c - yj, c) + d 2 \\ rand 2 (qh, c - yh, c)] \end{matrix}$ (19) $\begin{matrix} u_{i, c}^{s + 1} = & [{zu}_{j, c}^{s} + d 1 rand 1 (qj, c - yj, c) + d 2 \\ rand 2 (qh, c - yh, c)] \end{matrix}$ $y_{j, c}^{s + 1} = yj, c + u_{j, c}^{s + 1}$ (20)

We can get the ultimate optimum solution for our multi-objective issue from this. The ideal heaviness values of the RM-DNN model are filled by the components of Hbest.

4.3 Sentimental analysis

The final phase of the proposed work is sentimental analysis, in which the digital evidence proof is classified as four different output classes are critical, error, warning, and information. Here, we illustrate a novel multistage dynamic neural network (MDNN) for crime action classification. A MDNN is a session of synthetic neural networks wherever the connection between nodes creates a map, with or without a temporary array. This permits it to exhibit temporal dynamic behavior. Both types of networks exhibit transient dynamic behavior. The hidden layers and classical neural network layers can retrieve information from a range of sensory data. In addition, the specific approach achieves sensor integration at the data level by combining data from multiple sensors. The MDNN classifier tasks can be handled better than multiple inputs to multiple solutions, but are not compatible with the problem mentioned in this broadsheet. This is input to this circuit is a time sequence, the value of every input has a continuous connection, and the seismic input of the preceding disturbs the seismic reply of the next moment. Also, there is a clear hysteria when accelerating tilt heights and story loss. The structure of MDNN classifier is extended to this function. The main purpose is that the construction of the MDNN classifier permits material to be exchanged each time g_s, $g_{s}^{(m)} = σ (Z_{s}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + V_{s}^{(m)} g_{s - 1}^{(m)} + a_{f}^{(m)})$ (21) However, one of the problems with the simple MDNN classifier is that the end nodes are too weak to extract material from the period nodes at huge intervals. The hidden layer suggests solving the long-term dependency problem by using the gateway system to regulate the stream and loss of material. The input, output, and output ports are the main parts of the hidden layer. The onward transmission process is uttered as values. In fact, the hidden layer has two parts: one multiplies the long-term recall of the preceding minute by the elapsed gate, and the other is multiplied by the gate of the entrance of the newly acquired knowledge of this moment. $j_{s}^{(m)} = σ (Z_{j}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{j}^{(m)}$ (22) $f_{s}^{(m)} = σ (Z_{f}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{f}^{(m)}$ (23) $O_{s}^{(m)} = σ (Z_{O}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{O}^{(m)})$ (24) $g_{s}^{(m)} = O_{O}^{(m)} . tan g (D_{s})$ (25) ${\tilde{D}}_{s}^{(m)} = tan g (Z_{d}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{d}^{(m)})$ (26) $D_{s}^{(m)} = f_{s}^{(m)} . D_{s - 1}^{(m)} + j_{s}^{(m)} . {\tilde{D}}_{s}^{(m)}$ (27) Here, $j_{s}^{(m)}$ , $f_{s}^{(m)}$ , $O_{O}^{(m)}$ and $D_{s}^{(m)}$ are the response gate, elapsed gate, production gate and cell national unit of the s^th hidden layer at time s, correspondingly; $Z_{j}^{(m)}$ , $Z_{f}^{(m)}$ , $Z_{o}^{(m)}$ and $Z_{d}^{(m)}$ are all weight coefficient conditions; $a_{j}^{(m)}$ , $a_{f}^{(m)}$ , $a_{o}^{(m)}$ and $a_{d}^{(m)}$ are all bias trajectories. Additionally, GRU layer is an option for hidden layer with fewer options and faster learning integration. The structure of MDNN classifier is shown in Fig. 2. Instead of forgetting GRU gates and input gates, update gates are used and its deployment process is as follows. $R_{s}^{(m)} = σ (Z_{R}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{R}^{(m)})$ (28) $W_{s}^{(m)} = σ (Z_{W}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{W}^{(m)})$ (29) ${\tilde{g}}_{s}^{(m)} = tan g (Z_{g}^{(m)} . [R_{s}^{(m)}, g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{g}^{(m)})$ (30) $g_{s}^{(m)} = (1 - Z_{s}^{(m)}) . {\tilde{g}}_{s}^{(m)} + W_{s}^{(m)} . g_{s - 1}^{(m)}$ (31)

Fig. 2

Structure of our proposed MDNN classifier.

Here, $Z_{s}^{(m)}$ and $R_{s}^{(m)}$ are the apprise access and rearrange access of the nth GRU level at time s, correspondingly; ${\tilde{g}}_{s}^{(m)}$ is the applicant value; $g_{s - 1}^{(m)}$ is the preceding output worth. Its value noticing that $Z_{s}^{(m)}$ can help to remember long-term dependences of a time arrangement, and $R_{s}^{(m)}$ can assistance to imprisonment short time dependences. Algorithm 3 describes the working function of optimal route computation using MDNN classifier.

Algorithm 3 Crime action classification suing MDNN classifier

Input : Optimized features
Output: Crime action classification (critical, error, warning and information)
1	Initialize the values for the input parameters
2	Set a sample training as $g_{s}^{(m)} = σ (Z_{s}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + V_{s}^{(m)} g_{s - 1}^{(m)} + a_{f}^{(m)})$
3	Compute hidden layer of network using $g_{s}^{(m)} = (1 - Z_{s}^{(m)}) . {\tilde{g}}_{s}^{(m)} + W_{s}^{(m)} . g_{s - 1}^{(m)}$
4	Optimizes hidden layer using $R_{s}^{(m)} = σ (Z_{R}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{R}^{(m)})$
5	End while
6	Optimize offset using $W_{s}^{(m)} = σ (Z_{W}^{(m)} . [g_{s - 1}^{(m)}, y_{s}^{(m)}] + a_{W}^{(m)})$
7	End

5 Results and discussion

The planned HDL-DFI model’s efficacy has been tested and assessed using common benchmark datasets. The suggested HDL-DFI model’s results are compared to current logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models in this research. Initially, the intended HDL-DFI model was tested on a Lenovo G500 s with an Intel Core i5 4th generation CPU with 8GB of RAM and a 1TB HDD running on a 64-bit version of Microsoft Windows. The Lenovo Idea-pad IP-320E 64-bit Windows 10 Home Edition operating system has 8 GB RAM, and a 256 GB SSD running i7 6th generation CPU to speed up model training. Anaconda Navigator utilized Python version 3.7 as the major programming language, with spyder and Jupyter as the launch environments.

5.1 Dataset description

We gathered data for this project from a number of well-known sources. As a consequence of the emergence of chat software, text communication has grown increasingly prevalent. A lot of evidence was acquired in a criminal case using structured communicative email. Harassment, sexual harassment, and defamation may all be discovered by analyzing the text’s content. Because video streams are often huge, monitoring, analyzing, and extracting significant data requires a variety of approaches. YouTube videos and CCTV camera footage are both good sources of video data. Extracts audio data from numerous features databases (MFD) such as EMODB, IEMOCAP, FAU AIBO, and others. As a source of criminal activity, images are a fast and simple method of communicating information. Instagram photographs, Twitter images, Flickr photos, and other visual data are examples. Each piece of linked data should be carefully analysed, not only to see if there are any frequent or uncommon occurrences, but also to see if there are any interesting events that fit within the system’s stated categories, such as crime’s name and complexity, error warning, and information. Table 2 indicates the number of times each item was used in the measured dataset.

Table 2
Dataset descriptions

Crime action Number of events

Critical 42

Error 7344

Warning 1193

Information 29405

37984

Crime action	Number of events
Critical	42
Error	7344
Warning	1193
Information	29405
	37984

5.2 Performance metrics

The simulation result of the proposed HDL-DFI model is compared with existing logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models in terms of accuracy, precision, recall, F1-score, G-mean, and AUC. All these parameters are defined as follows: $Accuracy = \frac{T_{P} + T_{N}}{T_{P} + T_{N} + F_{P} + F_{N}}$ (32) $Precision = \frac{T_{P}}{T_{P} + F_{P}}$ (33) $Re call = \frac{F_{P}}{T_{N} + F_{P}}$ (34) $F 1 score = \frac{2 x T_{P}}{2 x T_{P} + F_{P} + F_{N}}$ (35) $G - mean = \sqrt{\frac{T_{P}}{T_{P} + F_{N}}} x \frac{T_{N}}{T_{N} + F_{P}}$ (36) $AUC = \frac{1 + \frac{T_{N} - F_{P}}{T_{N} + F_{P}}}{2}$ (37) where, T_P: The real occurrences are divided into two categories: disorder and disorder. F_P: The real occurrences are divided into two categories: disorder and disorder.T_N: The instances’ true teachings are as healthy and private as the healthy, F_N: The instances’ class is as healthy and private as the disease.

5.3 Comparative analysis

As previously mentioned, the HDL-DFI model was designed to improve the presentation of criminal action detection and categorization. The proportionate analysis of planned and current state-of-the-art models is shown in Table 3. The proposed HDL-DFI outperforms the current logistic regression, multi-layer perception, KNN, random forest, Adaboost and deep learning models by 17.036 percent, 8.043 percent, 3.700 percent, 4.159 percent, 19.244 percent and 1.094 percent respectively. The proposed HDL-DFI model outperforms the current logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models by 10.023 percent, 20.242 percent, 11.934 percent, 14.807 percent, 11.366 percent, and 0.827 percent respectively. The recall of proposed HDL-DFI model is 19.415%, 28.679%, 4.637%, 2.375%, 22.503% and 3.801% higher than the existing logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models respectively.

Table 3
Dataset descriptions

Models Performance metrics (%)

Accuracy Precision Recall F1 score G-mean AUC

Logistic regression 81.18 87.08 79.07 82.01 93.07 91.74

Multi-layer perceptron 89.98 77.19 69.98 78.91 91.98 89.96

KNN 94.23 85.23 93.57 97.37 86.04 87.36

Random forest 93.78 82.45 95.79 98.18 90.75 92.25

Adaboost 79.02 85.78 76.04 81.00 95.07 94.14

Deep learning 96.78 95.98 94.39 98.78 93.04 95.76

HDL-DFI 97.85 96.78 98.12 99.14 96.78 96.08

Models	Performance metrics (%)
Logistic regression	81.18	87.08	79.07	82.01	93.07	91.74
Multi-layer perceptron	89.98	77.19	69.98	78.91	91.98	89.96
KNN	94.23	85.23	93.57	97.37	86.04	87.36
Random forest	93.78	82.45	95.79	98.18	90.75	92.25
Adaboost	79.02	85.78	76.04	81.00	95.07	94.14
Deep learning	96.78	95.98	94.39	98.78	93.04	95.76
HDL-DFI	97.85	96.78	98.12	99.14	96.78	96.08

The F1-score of projected HDL-DFI model is 17.279%, 20.405%, 1.785%, 0.968%, 18.297% and 0.363% higher than the existing logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models respectively. The G-mean of proposed HDL-DFI model is 3.833%, 4.960%, 11.097%, 6.231%, 1.767% and 3.864% higher than the existing logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models respectively. The AUC of proposed HDL-DFI model is 4.517%, 6.370%, 9.076%, 3.986%, 2.019% and 0.333% higher than the existing logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models respectively. Figures 3-8 show the graphical representation of comparative analysis for accuracy, recall, F1-score, precision, G-mean and AUC respectively.

Fig. 3

Accuracy comparison of proposed and existing models.

Fig. 4

Precision comparison of proposed and existing models.

Fig. 5

Recall comparison of proposed and existing models.

Fig. 6

F1-score comparison of proposed and existing models.

Fig. 7

G-mean comparison of proposed and existing models.

Fig.8

AUC comparison of proposed and existing models.

Fig. 9

Total computation time of proposed and existing models.

For the test scenario of the upload process, the computation time of proposed HDL-DFI model with familiar and unfamiliar is 20% and 25% lower than the existing digital proof collective model [1]. For the test scenario of authentication generation, the computation time of the proposed HDL-DFI model with familiar and unfamiliar is 22% and 29% lower than the existing digital proof collective model. For the test scenario of index service, the computation time of the proposed HDL-DFI model with familiar and unfamiliar is 23.78% and 31.26% lower than the existing digital proof collective model. For the test scenario of familiarity checking, the computation time of the proposed HDL-DFI model with familiar and unfamiliar is 24.097% and 32.02% lower than the existing digital proof collective model.

6 Conclusion

For forensic enquiry, we suggested a hybrid deep learning approach based on integrated multi-model data fusion (HDL-DFI). The following are the primary contributions of the suggested as shadows:

A digital evidence collection and management system is achieved through an improved brain storm optimization (IBSO) algorithm.

Data de-duplication is done by recurrent multiplicative neurons with a deep neural network (RM-DNN) technique.

Finally, a multistage dynamic neural network (MDNN) is used for sentimental analysis to classify the crime action.

Finally, the simulation results of our proposed HDL-DFI model are effective as compared to the existing logistic regression, multi-layer perceptron, KNN, random forest, Adaboost and deep learning models in terms of accuracy, recall, precision, F1-score, G-mean, and AUC. The total computation time of proposed HDL-DFI model is very low compared to existing state-of-art digital proof collective model for different test scenarios such as upload, authentication generation, index service, and familiarity checking.

References

Senthil

, Selvakumar

Digital proof collective model using integrated fusion data modelling, Wireless Personal Communications (2021), 1–14.

Cheng

C.C.C.

, Shi

, Gong

N.Z.

and Guan

, LogExtractor: Extracting digital evidence from android log messages via string and taint analysis, Forensic Science International: Digital Investigation 37 (2021), 301193.

Belshaw

and Nodeland

, Digital evidence experts in the law enforcement community: understanding the use of forensics examiners by police agencies, Security Journal (2021), 1–15.

Hemdan

E.E.D.

and Manjaiah

D.H.

, An efficient digital forensic model for cybercrimes investigation in cloud computing, Multimedia Tools and Applications 80(9) (2021), 14255–14282.

Al Mutawa

, Bryce

, Franqueira

V.N.

, Marrington

and Read

J.C.

, Behavioural digital forensics model: embedding behavioural evidence analysis into the investigation of digital crimes, Digital Investigation 28 (2019), 70–82.

Nikkel

, Fintech forensics: Criminal investigation and digital evidence in financial technologies, Forensic Science International: Digital Investigation 3 (2020), 200908.

Tok

Y.C.

, Wang

, Chattopadhyay

Stitcher: Correlating digital forensic evidence on internet-of-things devices, Forensic Science International: Digital Investigation (2020), 1–14.

Amato

, Cozzolino

, Moscato

and Moscato

, Analyse digital forensic evidences through a semantic-based methodology and NLP techniques, Future Generation Computer Systems 98 (2019), 297–307.

Ryu

J.H.

, Sharma

P.K.

, Jo

J.H.

and Park

J.H.

, A blockchain-based decentralized efficient investigation framework for IoT digital forensics, The Journal of Supercomputing 75(8) (2019), 4372–4387.

10.

Bhardwaj

, Dave

Crypto-preserving investigation framework for deep learning based malware attack detection for network forensics, Wireless Personal Communications (2021), 1–22.

11.

Awuson-David

, Al-Hadhrami

, Alazab

, Shah

and Shalaginov

, BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem, Future Generation Computer Systems 122 (2021), 1–13.

12.

Jung

P.Y.

and Tsai

F.C.

, An AutoTriage B-CoC model in digital forensic investigation, Procedia Computer Science 176 (2020), 1729–1735.

13.

Trail

P.W.

, Morphological species identification of wildlife forensic evidence based on digital images, Forensic Science International: Animals and Environments 1 (2021), 100021.

14.

, Lal

, Conti

, Hu

, LECha, A blockchain-based lawful evidence management scheme for digital forensics, Future Generation Computer Systems 115 (2021), 406–420, .

15.

Ladegaard

, Crime displacement in digital drug markets, International Journal of Drug Policy 63 (2019), 113–121.

16.

Kelty

S.F.

, McQueen

, Pymont

and Green

, avoiding burnout at the digital forensics coalface: targeted strategies for forensic agencies in the management of job-related stress, Forensic Science International: Digital Investigation 38 (2021), 301127.

17.

Costantini

and De

, Gasperis and R. Olivieri, Digital forensics and investigations meet artificial intelligence, Annals of Mathematics and Artificial Intelligence 86(1) (2019), 193–229.

18.

Rogers

, From time theft to time stamps: mapping the development of digital forensics from law enforcement to archival authority, International Journal of Digital Humanities 1(1) (2019), 13–28.

19.

Omeleze

, Venter

H.S.

, May. Acquisition and retention of potential digital evidence. In 2017 IST-Africa Week Conference (IST-Africa) (2017), 1–10. IEEE.

20.

Nalawade

, Bharne

, Mane

, September. Forensic analysis and evidence collection for web browser activity. In 2016 International Conference on Automatic Control and Dynamic Optimization Techniques (ICACDOT) (2016), 518–522. IEEE.

21.

Kao

D.Y.

, Chao

Y.T.

, Tsai

, Huang

C.Y.

, November. Digital evidence analytics applied in cybercrime investigations. In 2018 IEEE Conference on Application, Information and Network Security (AINS) (2018), 111–116. IEEE.

22.

Mohite

M.P.

, Deshmukh

J.Y.

, Gulve

P.R.

, January. Qualitative and quantitative analysis of cloud based digital forensic tool. In 2016 10th International Conference on Intelligent Systems and Control (ISCO) (2016), 1–5. IEEE.

23.

Singh

K.S.

, Irfan

, Dayal

, November. Cyber Forensics and Comparative Analysis of Digital Forensic Investigation Frameworks. In 2019 4th International Conference on Information Systems and Computer Networks (ISCON) (2019), 584–590. IEEE.

24.

Hemdan

E.E.D.

, Manjaiah

D.H.

CFIM: toward building new cloud forensics investigation model. In Innovations in Electronics and Communication Engineering (2018),545–554. Springer, Singapore.

25.

Calvo

R.A.

and D’Mello

, Affect detection: An interdisciplinary review of models, methods, and their applications, IEEE Transactions on Affective Computing 1(1) (2010), 18–37.

26.

Lim

K.S.

and Lee

, A framework for unified digital evidence management in security convergence, Electronic Commerce Research 13(3) (2013), 379–398.

27.

Wenhua

and Na

, April. Application of unstructured data processing and analyzing base on chinese in digital data evidence collecting. In 2010 2nd International Conference on Computer Engineering and Technology 7 (2010), V7–780. IEEE.

28.

Bulbul

H.I.

, Yavuzcan

H.G.

and Ozel

, Digital forensics: an analytical crime scene procedure model (ACSPM), Forensic Science International 233(1-3) (2013), 244–256.

29.

Karie

N.M.

, Venter

H.S.

, Towards a framework for enhancing potential digital evidence presentation. In 2013 Information Security for South Africa (2013), 1–8. IEEE.

30.

Gogolin

, The digital crime tsunami, Digital Investigation 7(1-2) (2010), 3–8.

31.

Wang

S.J.

, Measures of retaining digital evidence to prosecutecomputer-based cyber-crimes, Computer Standards & Interfaces 29(2) (2007), 216–223.

32.

Tao Zhang , Changfu Yang , Xin Zhao Using Improved Brainstorm Optimization Algorithm for Hardware/Software Partitioning. In 2019 Applied Sciences (2019), 1–17.

Models	Performance metrics (%)
	Accuracy	Precision	Recall	F1 score	G-mean	AUC
Logistic regression	81.18	87.08	79.07	82.01	93.07	91.74
Multi-layer perceptron	89.98	77.19	69.98	78.91	91.98	89.96
KNN	94.23	85.23	93.57	97.37	86.04	87.36
Random forest	93.78	82.45	95.79	98.18	90.75	92.25
Adaboost	79.02	85.78	76.04	81.00	95.07	94.14
Deep learning	96.78	95.98	94.39	98.78	93.04	95.76
HDL-DFI	97.85	96.78	98.12	99.14	96.78	96.08

A hybrid deep learning technique based integrated multi-model data fusion for forensic investigation

Abstract

Keywords

1 Introduction

2 Related works

3.1 Problem statement

3.2 System design of proposed HDL-DFI model

4.1 Digital evidence collection and management system

5.1 Dataset description

Table 2 Dataset descriptions Crime action Number of events Critical 42 Error 7344 Warning 1193 Information 29405 37984

References

Table 2
Dataset descriptions

Crime action Number of events

Critical 42

Error 7344

Warning 1193

Information 29405

37984