Stream Clustering on a Forensic Timeline

Digital forensics heavily relies on forensic timelines to maintain a chronological record of events and activities. With the exponential growth of digital activity, it is a significant challenge to efficiently categorize related events on these timelines. Inefficient memory utilization is the primary challenge, as forensic timelines contain large and complex data, causing the capability to process data incrementally. This paper introduces an innovative approach that employs stream clustering techniques for event segmentation and categorization within forensic timelines. It considers forensic timelines as dynamic data streams that adapt in real-time to incoming events. This approach optimizes the processing and grouping of emerging events by leveraging temporal patterns and evolving event contexts, unlike traditional clustering methods that require complete datasets. In this study, three-stream clustering algorithms were tested, and it was discovered that link clustering produced the lowest score in silhouette score and Davies-Bouldin Index with the highest score in Calinski-Harabasz Index compared to DenStream and BIRCH. This concluded that link clustering performs the best clustering among these three algorithms.