Likelihood ratios for changepoints in categorical event data with applications in digital forensics

Longjohn, Rachel; Smyth, Padhraic

Likelihood ratios for changepoints in categorical event data with applications in digital forensics

File

2024-Longjohn-LikelihoodRatiosChangepoints.pdf (3.48 MB)

Date

2024-04-01

Authors

Longjohn, Rachel

Smyth, Padhraic

Publisher

Wiley Periodicals LLC on behalf of American Academy of Forensic Sciences

Abstract

We investigate likelihood ratio models motivated by digital forensics problems involving time-stamped user-generated event data from a device or account. Of specific interest are scenarios where the data may have been generated by a single individual (the device/account owner) or by two different individuals (the device/account owner and someone else), such as instances in which an account was hacked or a device was stolen before being associated with a crime. Existing likelihood ratio methods in this context require that a precise time is specified at which the device or account is purported to have changed hands (the changepoint)—this is the known changepoint likelihood ratio model. In this paper, we develop a likelihood ratio model that instead accommodates uncertainty in the changepoint using Bayesian techniques, that is, an unknown changepoint likelihood ratio model. We show that the likelihood ratio in this case can be calculated in closed form as an expression that is straightforward to compute. In experiments with simulated changepoints using real-world data sets, the results demonstrate that the unknown changepoint model attains comparable performance to the known changepoint model that uses a perfectly specified changepoint, and considerably outperforms the known changepoint model that uses a misspecified changepoint, illustrating the benefit of capturing uncertainty in the changepoint.

Academic or Administrative Unit

Center for Statistics and Applications in Forensic Evidence

Type

Article

Comments

This article is published as Longjohn, Rachel, and Padhraic Smyth. "Likelihood ratios for changepoints in categorical event data with applications in digital forensics." Journal of Forensic Sciences (2024). doi:10.1111/1556-4029.15512. © 2024 The Authors. Posted with permission of CSAFE.
This is an open access article under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs License, which permits use and distribution in any medium, provided the original work is properly cited, the use is non-commercial and no modifications or adaptations are made.