Zero-Shot Anomaly Detection in a Forensic Timeline

A central aspect of digital forensics involves analyzing forensic timelines to uncover sequences of events in computer systems. A forensic timelines might contain several anomalous events. Detecting anomalies in these timelines is important for identifying potential security breaches and malicious activities. Current solutions for detecting anomalies in forensic timelines utilize deep learning and sentiment analysis. In this work, we propose an approach for performing anomaly detection using a zero-shot learning technique in forensic timelines. Our proposed framework uses pre-trained large language models to automatically identify anomalous events and activities without requiring prior training data that is specific to each anomaly. The experimental results show that the method we proposed achieves the highest accuracy score of 98.16% tested on five public datasets.