Specializing CRISP-DM for Evidence Mining

The use of all forms of computer and communication devices is changing human interaction and thinking. Electronic traces of actions and activities are continually being left behind most often unknowingly so. This situation creates opportunities for criminal investigators to make use of these traces and marks to uncover evidence. In this evidentiary discovery process several problems are experienced including the linking of unstructured pieces of data to an evidence trail. Analysis is a crucial aspect of the overall Cyber Forensic process for which adequate support is not provided. In this article it is argued that in order to alleviate the situation around analysis and further the foundations of cyber forensics it is necessary to learn from another field that also needs to deal with vast amounts of information and develop methods for automated interpretation thereof; the field of Knowledge Discovery and Data Mining (KDD). A specialization of a well known KDD process (CRISP-DM) is developed and named CRISP-EM. The process of specialization is described and some of the results are shown. It is further shown that the CRISP-EM methodology supports a structured approach in defining the research gaps in evidence mining.