AI-Driven Network Forensics: Ensuring Evidence Integrity with Merkle Tree-Based Tamper-Proof Logging

Ensuring the authenticity and integrity of digital forensic evidence is crucial in cybercrime investigations. Conventional forensic logging systems suffer from vulnerabilities such as tampering, unauthorized modifications, and integrity breaches. This paper proposes an AI-driven network forensic framework integrating machine learning-based anomaly detection and Merkle Tree-based tamper-proof logging. The system enhances forensic log security while ensuring verifiability and legal admissibility. Using CICIDS 2017 and UNSW-NB15 datasets, the CNN model achieved 96.2% accuracy, outperforming traditional models. The Merkle Tree-based forensic logging demonstrated a 99.9% tamper detection rate with a low verification latency of 260ms, making it a computationally efficient alternative to blockchain. This research enhances forensic investigations by combining intelligent anomaly detection with cryptographic integrity verification, ensuring immutable and reliable forensic logs for cybercrime analysis.