Sentiment Analysis in a Forensic Timeline with Deep Learning

Hudan Studiawan*, Ferdous Sohel, Christian Payne

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

30 Citations (Scopus)


A forensic investigator creates a timeline from a forensic disk image after an occurrence of a security incident. This procedure aims to acquire the time for all events identified from the investigated artifacts. An investigator usually looks for events of interest by manually searching the timeline. One of the sources from which to build a timeline is log files, and these events are often found in log messages. In this paper, we propose a sentiment analysis technique to automatically extract events of interest from log messages in the forensic timeline. We use a deep learning technique with a context and content attention model to identify aspect terms and the corresponding sentiments in the forensic timeline. Terms with negative sentiments indicate events of interest and are highlighted in the timeline. Therefore, the investigator can quickly examine the events and other activities recorded within the surrounding time frame. Experimental results on four public forensic case studies show that the proposed method achieves 98.43% and 99.64% for the F1 score and accuracy, respectively.

Original languageEnglish
Article number9047947
Pages (from-to)60664-60675
Number of pages12
JournalIEEE Access
Publication statusPublished - 2020


  • Forensic timeline
  • content attention
  • context attention
  • deep learning
  • event logs
  • sentiment analysis


Dive into the research topics of 'Sentiment Analysis in a Forensic Timeline with Deep Learning'. Together they form a unique fingerprint.

Cite this