Grant: Discovery Grants Program - Individual

With the spike in the number and scale of cyberattacks, digital forensic (DF) has become an indispensable tool for security experts. Cyberattacks are costing businesses trillions of dollars, and the loss of billions of personal and financial records (and possible meddling with elections). Executing digital forensics after a security incident becomes a necessity to identify root causes and possibly individuals behind the attack. It can also help to avoid future similar incidents, and when possible, accelerate the restoration of any service affected. However, digital forensics is becoming a very complex and overwhelming task due to a number of reasons including; (1) the large number of data sources of forensic interest and sometimes in proprietary formats, (2) the enormous volume of forensic data, and last but not least, (3) the association of new technologies in cyberattacks (Blockchain, Internet of Things (IoT), Connected and Autonomous Vehicles, Drones, and cloud/edge/fog computing). These all add convolution to the processes of digital evidence acquisition, triage and analysis. In this research program, I propose to investigate the design and implementation of a forensic framework and associated tools that use machine learning algorithms combined with big data visual analytics that go beyond the current state of the art of forensic tools. The outcome of the program will help cut the time and cost for digital forensic investigations, by providing digital forensic analyst with the knowledge and tools to better unveil, understand and evidence pieces. Additionally, the program will address real-world data analytic problem leading to enormous social and economic benefits. Last but not least, the program will also contribute to the development of research talents and the training of HQP in machine learning and visual analytics, positioning Canada as a leader in these fields.