User profiling via application usage pattern on digital devices for digital forensics

Hongkyun Kwon, Sangjin Lee, Doowon Jeong

Research output: Contribution to journalArticlepeer-review

8 Citations (Scopus)


In digital forensics, user profiling aims to predict characteristics of the user from digital evidence extracted from digital devices (e.g. smartphone, laptop, tablet). Previous researches showed promising results, but there are limitations to apply practical investigations. The researches so far have focused only on specific applications, devices, or operating systems by analyzing the order of execution or volatile data such as network traffic and online content. This paper introduces a user profiling method, named Entity Profiling with Binary Predicates (EPBP) model, which analyzes non-volatile data remained on digital devices. The proposed model defines that a user has two properties: tendency and impact, which indicate patterns of application usage. Based on the attributes, the EPBP model generates users’ profiles and performs similarity analysis to differentiate between the users. We also present methods for clustering and anomaly detection through real case studies.

Original languageEnglish
Article number114488
JournalExpert Systems With Applications
Publication statusPublished - 2021 Apr 15

Bibliographical note

Publisher Copyright:
© 2020 Elsevier Ltd


  • Anomaly detection
  • Application usage
  • Digital forensics
  • User profiling
  • User similarity

ASJC Scopus subject areas

  • General Engineering
  • Computer Science Applications
  • Artificial Intelligence


Dive into the research topics of 'User profiling via application usage pattern on digital devices for digital forensics'. Together they form a unique fingerprint.

Cite this