Cybersecurity-Driven Machine Learning Approaches for The Web Browser Digital Forensics: A Comparative AnalysisOf Classification Performances on Browser Artifact Data

Abstract

Selecting a machine learning algorithm with optimal precision, accuracy, and recall has been a major challenge in cybersecurity and digital ‎forensic analysis. Common challenges include difficulty in impact visualization, deterioration in efficiency when datasets are large, the discretized nature of datasets, complex relationships among variables, linearity assumptions, overfitting, and other related issues. In an attempt ‎to mitigate these challenges in practice, this study aims to compare the classification performance of machine learning algorithms applied to ‎web browser extracts in digital forensics. Consequently, the most efficient algorithm is proposed for forensic analysis. The study utilized ‎data from 20 computers, each installed with web browsers including Microsoft Internet Explorer, Microsoft Edge, Google Chrome, Mozilla ‎Firefox, and Opera. Browser extracts were obtained using the Web Browser Forensic Analyzer (WEFA) tool (version 1.2). Browser artefacts were extracted and categorized into history, cache, cookies, typed URLs, sessions, most visited sites, screenshots, downloaded files, ‎favorites, bookmarks, and thumbnails. The dataset consisted of counts of artefacts extracted from the browsers. Data collection was further ‎supported by Firefox Forensic Analyzer and Google Chrome Analyzer tools. The Python programming language was used as the primary ‎tool for implementing and evaluating the performance of the machine learning algorithms. During the implementation process, the study ‎assessed the performance of the Linear Discriminant Algorithm against five competing classification algorithms: Logistic Regression, Decision Tree Classifier, K-Nearest Neighbors, Naive Bayes Classifier, and Support Vector Classifier. The findings revealed that the Linear ‎Discriminant Algorithm outperformed the competing algorithms in terms of accuracy, precision, recall, and F1-score. The study therefore ‎concludes that the Linear Discriminant Algorithm is an enhanced and effective approach for classifying browser extracts (artefacts) in digital ‎forensic investigations‎.