Title: Exploring machine learning techniques for detecting anomalies in digital forensics: a survey

Authors: Khawla Almutawa; Afef Selmi; Tarek Moulahi

Addresses: Department of Information Technology, College of Computer, Qassim University, Buraydah 51452, Saudi Arabia ' Department of Information Technology, College of Computer, Qassim University, Buraydah 51452, Saudi Arabia; RIADI Laboratory, ENSI, University of Manouba, Tunisia ' Department of Information Technology, College of Computer, Qassim University, Buraydah 51452, Saudi Arabia

Abstract: Cybercrime has recently and rapidly increased as a result of the extensive use of various digital devices. Digital forensic science, which was established to address issues of cybercrime, follows a defined approach to gathering digital evidence. In recent years, there has been a growing number of studies focusing on employing machine learning and deep learning in digital forensics applications. This research is motivated by the increasing importance of digital forensics and cybersecurity and the need for accurate and efficient tools to detect and mitigate potential security breaches and other forms of anomalous behaviour in digital systems. The purpose of this study is to conduct a literature review to obtain a comprehensive understanding of this topic, specifically deployed models, data preprocessing mechanisms, anomaly detection techniques, and evaluations. This review will help to identify gaps in the existing knowledge and potentially uncover new approaches to the topic. This review conducts a comprehensive literature review on anomaly detection in log files using ML and DL techniques. It will help to identify gaps in the existing knowledge and potentially uncover new approaches to the topic. Initial results indicate that deep learning methods show promise in effectively dealing with the intricate characteristics of log data.

Keywords: digital forensics; DF; machine learning; ML; anomaly detection; log files.

DOI: 10.1504/IJESDF.2026.150186

International Journal of Electronic Security and Digital Forensics, 2026 Vol.18 No.1, pp.81 - 107

Received: 10 Jan 2024
Accepted: 09 Apr 2024
Published online: 03 Dec 2025 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article