A New Algorithm to Estimate the Similarity between the Intentions of the Cyber Crimes for Network Forensics

Given the rapidly increasing amount of digital crimes, network forensics plays a significant role in the process of analyzing evidence. Current cyber crime investigation techniques are very costly and time consuming because much effort is needed to analyze the overwhelming amount of evidence in each case. More information is required to understand and analyze the factors involved in cyber crime, such as the intention of the crime. This paper proposes a new algorithm called the Similarity of Attack Intention (SAI), which uses cosine similarity as a distance-based similarity measure to estimate similar cyber crime intentions. The algorithm is based on the Attack Intention Analysis (AIA) algorithm to predict new cyber crime intentions and assigned the probability values for these intentions. A similarity metric for the new cyber crimes intentions with others is generated in order to identify the similar intentions. The evaluation of example cyber crime results shows that our proposed algorithm provides better solutions and increases the possibility value of evidences.