International Journal of Technology and Emerging Research
DOI: 10.64823/ijter.2604010
A HYBRID MACHINE LEARNING–DEEP LEARNING FRAMEWORK FOR EXPLAINABLE AND SCALABLE DIGITAL FORENSIC ANALYSIS
Soni Rameshrao Ragho1*, Narendra Chaudhari2
1Research Scholar, 2Research Supervisor, *Corresponding Author: 1sonirragho@gmail.com
Department of Computer Science and Engineering
Mansarovar Global University, Bhopal (M.P), India
Abstract: The intensive development of new digital technologies, cloud computing, and networked systems made the amount and complexity of the digital evidence in cases of cybercrime investigation significantly greater. Manual and rule-based digital forensic techniques cannot manage large-scale heterogeneous and real-time data environments. Such systems are not always scalable, interpretable, and robust, which restricts their applicability in the current cyber threats. To address these issues, this paper suggests a Hybrid AI-Based Forensic Intelligence Framework that could be used to analyze digital evidence in scales and provide an explanation and real-time analysis. The suggested framework will combine some of the latest methods of artificial intelligence, such as machine learning, deep learning, and explainable artificial intelligence (XAI), to automate and improve the process of forensics. It helps in preprocessing data, feature extractions, anomaly detection, correlation of evidence and transparent decision making. The system can effectively handle a wide range of sources of data including system logs, network traffic, and multimedia artifacts using scalable hybrid models. Also, explainability properties provide legal reliability and transparency of forensic results. The experimental findings indicate that there are better accuracy, scalability, and reliability as opposed to traditional tools and single-model solutions. On the whole, the framework offers a powerful and intelligent approach to digital forensics in the modern context related to the investigation and making decisions more efficient in a complex cybercrime situation.
Keywords: Digital Forensics; Artificial Intelligence; Explainable AI; Cybersecurity; Machine Learning; Real-Time Evidence Analysis; Forensic Intelligence Framework
The advent of the digital technologies, cloud, and IoT has grown at a fast pace, which has contributed to the substantial increase in the amount and the complexity of digital evidence in contemporary cybersecurity. Digital forensics is an important method in the investigation of cybercrimes, since it is used to gather, retrieve, and analyze data in the form of network traffic, system logs, and devices. Nevertheless, conventional forensic techniques that involve manual examination and rule tools are limited to large, heterogeneous and dynamic cyber environments, which makes investigations both time-consuming and inefficient.
In a bid to counter such issues, Artificial Intelligence (AI) has become an effective solution to automated and scalable analysis of digital evidence. Machine learning and deep learning are some of the techniques that can be used to efficiently detect patterns, identify anomalies, and recreate cyberattacks. This paper is driven by the requirement to have real-time, scalable, and interpretable systems, and, thus, it suggests a Hybrid AI-based Forensic Intelligence Framework that combines machine learning, deep learning, and explainable AI. The framework boosts automation, real time evidence processing and transparency, which reinforced effectiveness and reliability of digital forensic investigations.
The primary objectives of this research are as follows:
The paper is dedicated to developing a Hybrid AI-Driven Forensic Intelligence Framework, which is supposed to assist in scaling, explainable, and real-time examination of digital evidence in contemporary cyber-space. The general extent of this study is strongly concerned with the issues related to the processing of large amounts of heterogeneous digital forensic evidence produced by different types of digital sources, including system logs, network traffic logs, mobile devices, and the cloud.
The other notable feature of this research is that there are scalable data processing mechanisms that enable the forensic system to process key volumes of data produced in real-time cyber space. The research also adds to the development of intelligent digital forensic systems by offering a holistic framework that can facilitate scalable, explainable, and robust real-time digital evidence analysis in the current cybersecurity landscape.On the whole, the study applies to the development of intelligent digital forensic systems by offering a detailed framework that would allow supporting the investigation of digital evidence in a legal context and ensure the validity of digital evidence in a court of law.
One of the most comprehensive modern reviews on AI-powered cybersecurity systems was offered by Ali et al. (2025), who focused on the combination of machine learning and deep learning to improve the threat detection and automated response systems. Their synthesis indicated the need to have forensic intelligence systems which would deal with bulk of heterogeneous evidence in real time and be resilient in the changing pattern of attacks. This work formed a baseline on the creation of structures that are able to comply with unpredictable cyber conditions that produce more intricate digital artefacts.
Simultaneously, Afrin et al. (2026) explored the hybridization of deep learning intrusion detection models in smart grid communication networks and found that the more complex CNNGRU architecture provided a more efficient intrusion detection capability on complex attack vectors. They found that statistical learning coupled with the use of temporal pattern recognition helps the forensic systems to better distinguish between harmless and malicious actions in distributed data sources, which supports the significance of learning more than one mode in forensic practice.
Along with how transformer-based models and convolutional feature extractors can detect manipulated media with high accuracy, Sharma and Selwal (2026) analyzed the systematized analysis of deep learning techniques used in deepfake generation and detection. They indicated the weaknesses in existing deep learning strategies, especially being vulnerable to adversarial perturbations, which can be tremendous problems in terms of using deep learning in the real-world during forensics. In line with this, Abdel-Wahab and Alkhatib (2025) assessed deepfake identification models based on biometric inspiration, highlighting the importance of visual and behavioral cues fusion to identify synthetic content a vital ability in contemporary digital forensics that is endangered by advanced multimedia attacks.
Furizal et al. (2025) have further elaborated on this story by considering the ethical, social, and legal implications of the deepfake pornography, pointing at how these changing menaces affect vulnerable groups unequally. They suggested the inclusion of watermarking and proactive detection pipelines in forensic systems to combat ill use of the synthetic media hence demonstrating the interplay between algorithmic detection and societal effects in the forensic analysis.
Elucidable artificial intelligence is now a priority of forensic systems in need of trust and accountability. A digital twin-based, IoT-specific, and enhanced cybersecurity framework suggested by Wakili et al. (2025) is implemented to support IoT-based healthcare systems in detecting real-time anomalies, facilitating the implementation of such a system through predictive analytics and explainable models to facilitate the analysis of incident response by incident analysts. This article underscored the fact that forensic inferences have to be verifiable and justifiable, especially in case of incorporating autonomous detection modules.
On the same note, Ibrahim et al. (2026) have investigated the risk dynamics in the context of digital-twin-assisted smart infrastructure, where hybrid systematic reviews and expert validation can determine the vulnerability and forensic preparedness. Their results highlighted the importance of digital twins in the process of monitoring and simulation as well as the organization of the lines of evidence to recreate the event that will happen after.
Mohammadi et al. (2026) also were able to establish that blockchain coupled with digital twins generate provenance-conscience forensic data ecosystems where a record of non-mutable records and decentralized verification systems can augment evidentiary integrity. Their study noted the possibility of distributed ledger integration to curtail tampering and improve on transparency - which is an increasing demand of scalable and explainable forensic intelligence systems.
Combined, this recent research demonstrates a definite path of forensic research in the direction of hybrid AI systems that would balance analytical strength with interpretability, scalability, and ethical concerns. Ali et al. (2025) and Afrin et al. (2026) emphasized the importance of machine learning in enhancing threat discrimination, whereas Sharma and Selwal (2026), Abdel-Wahab and Alkhatib (2025), and Furizal et al. (2025) showed that there is an urgent necessity to strengthen the strategies of deep learning against manipulation and misuse. In the meantime, Wakili et al. (2025), Ibrahim et al. (2026), and Mohammadi et al. (2026) gave explanatory, evidence traceability, and secure forensic accounts frameworks. Together, these works highlight the changing environment in which forensic intelligence systems must not only be able to identify threats, but also in a way that is transparent, ethically and in a way that allows legal and investigative challenges to be made.
Figure 1: Hybrid AI–Driven Forensic Intelligence Framework for Scalable, Explainable, and Robust Real-Time Digital Evidence Analysis.
To test the effectiveness of the suggested Hybrid AI-driven Forensic Intelligence Framework, the publicly available cybersecurity dataset in Kaggle was utilized. The data will be a set of network traffic logs labeled as normal functioning of the system and malicious cyber-activity. These datasets are typically applicable in the field of digital forensics and intrusion detection studies as they offer valuable scenarios of cyber-attacks and a variety of network traffic.
The dataset used in this study is available on Kaggle:
Dataset Link:
https://www.kaggle.com/datasets/solarmainframe/ids-intrusion-csv
A publicly available cybersecurity dataset acquired at the Kaggle is used to assess the performance and effectiveness of the proposed Hybrid AI-Driven Forensic Intelligence Framework. The data set is a massive set of labeled network traffic logs of both normal system operations and different forms of cyberattacks. These datasets have found extensive application in the study of cybersecurity since they offer realistic network traffic dynamics, which can be used to train machine learning and deep learning models to learn patterns related to malicious behavior. With the help of this data, the suggested framework will be able to analyze digital evidence automatically and identify abnormal network behavior and help in forensic investigation.
The data source of this study is the IDES Intrusion Detection Dataset that can be located in the Kaggle database. This data is based on the CSE-CIC-IDS2018 dataset which was created to model real-world cyberattack conditions in an experimental environment by the Canadian Institute of Cybersecurity. The data was collected through the network traffic recording in the process of carrying out normal user actions and different attacks like denial-of-service attacks, brute force logins, botnet communications, and port scan actions. Consequently, the data set gives a realistic picture of what takes place in the network behaviors that take place in the contemporary computing environment.
The data set is made up of network flow characteristics out of the raw packet capture (PCAP) files. Every entry of the dataset represents a conversation between two network members and contains statistical features of the nature of the connection. These characteristics can be used to give good information on the behavior of a network such as the pattern of transmission of the packets, durability of flows, distribution of packet size, and protocol utilization. This kind of information can be used to detect suspicious activities and isolate normal and abnormal network traffic using machine learning algorithms.
The raw data that is received based on the dataset cannot be directly fed into machine learning and artificial intelligence models since it might include missing records, duplicate formation of attributes, and data of varying formats. Thus, the raw network traffic data needs to be transformed into a structured format, which can be analyzed, which necessitates an input data processing stage. This phase is significant in enhancing the output and dependability of the suggested Hybrid AI-Driven forensic Intelligence Framework.
The initial procedure in input data processing stage is data cleaning. In the process, redundant records and irrelevant data entries are cleared off the data to maintain consistency in data. Moreover, any missing values that could be in some attributes are processed using relevant methods including substitution of missing values with mean or median value, or dropping records that are not complete where the need arises. Data cleaning removes noise and enhances the quality of the dataset to be used in training of machine learning models.
The extraction of features is a significant process within the suggested model of forensic intelligence since it allows determining significant characteristics of the processed data that can be applied to detecting cyber threats. When dealing with large sets of network traffic, there are many features that characterize various communication behavior. Nevertheless, not every feature is as useful as the others in detecting malicious activities. Hence, the extraction of the most relevant features assists in enhancing the efficiency and accuracy of machine learning models applied in digital forensic analysis. In the extraction of the features, statistics and behavioral characteristics of network traffic are performed to extract patterns concerning suspicious actions.
The flow duration, packet transmission rate, and distribution of packet sizes, frequency of communications are some features that are useful in understanding network behavior. These characteristics enable the system to determine normal patterns of traffic and those related to abnormal activities that are connected to cyberattacks. Through such features, the proposed framework is in a position to identify anomalies and identify possible threats in large scale network settings.
The data collection stage will involve the collection of various digital evidence across the various sources of forensics to provide a complete reconstruction of events and real time visibility of threats. The data set will be comprised of system event logs, file system metadata, registry changes, process creation, network packets, IDS alerts, and memory snapshots that will be benign and malicious activities.
Let the forensic dataset be represented as:
The merged data set comprises of publicly available benchmark data sets (e.g., CIC-IDS2017, UNSW-NB15, CAIDA traces) and simulated malicious activities that conceptualize ransomware activities, data exfiltration, privilege escalation, and malware execution activities. This diversity will make sure that the framework will capture the real-world forensic variability and facilitate the correct investigation processes.The forensic artefacts collected usually have lost values, repeated records, time warps, and noise generated by system background processes. In order to achieve analytical reliability, a structured preprocessing pipeline is used, and it involves:
Feature normalization is performed using Min–Max scaling to create a uniform representation:
This standardization will make sure that features which have a high numeric range are not overpowering the learning process.
The use of feature extraction to determine the most informative forensic indicators that are needed in evidence classification, threat attribution, and detecting anomalies. A set of the forensic features is built out of the processed dataset:
F={f1,f2,f3,…,fn}
Such features are network flow statistics, pattern of process executions, metadata on file access, entropy scores, opcode sequences, and anomaly markers. Attributes with a significant contribution to forensic intelligence and threat reconstruction are selected with the help of statistical correlation, mutual information scoring and feature importance analysis.
The chosen features are sent to a hybrid machine learning model to either define digital artefacts as benign activity, suspicious event, or can confirm that they are malicious behaviors. Popular models such as Random Forest, Support Vector Machine (SVM), Gradient Boosting and Neural Networks are introduced to increase the robustness of prediction.
Here, Y=1 indicates malicious evidence, and Y=0 represents benign forensic artefacts.
The hybrid model combines statistical learning with deep feature representation to improve accuracy and interpretability.
The regression analysis is used on the time-scope and behavioral forensic indicators in order to recreate digital incidents and comprehend how malicious activities develop. This assists in finding the cause-effect links, the attack propagation, and the aberration escalation.
The regression equation is given by:
In this case, y is the severity or anomaly score and x are the forensic attributes including packet rates, process ages, entropy values or resource consumption trends.This forensic regression can be used to reconstruct an event, estimate a threat progression and determine how attackers behave over time.
The hybrid forensic intelligence model acquires behavioral patterns during the training phase on the curated dataset. The data is split into training and testing sets using typical proportions of 70:30 or 80:20 data to guarantee the ability to generalize. The cross-entropy loss is used to optimize the model parameters:
This reduction of the loss enhances the accuracy of the forensic classification of the model and enables the model to capture the slight differences between benign and malicious activities.Model assessment is used to estimate how well the forensic intelligence system can detect malicious events and provide proper investigative information. The metrics of standard evaluation, such as accuracy, precision, recall, and F1-score, are employed:
These metrics would give a holistic knowledge of the framework to assist in real time digital investigations which are high precision and low error rates. The Experimental Results section provided below is presented in the same tone, flow, structure, formatting, and heading style as your sample but in the entirety tailored to your Hybrid AI-Driven Forensic Intelligence Framework.
To determine the efficacy of the recommend Hybrid AI-based Forensic Intelligence Framework, a large-scale experiment was done on a rich forensic data set that comprised of multimodal digital evidence sources such as network flow records, system event logs, process execution traces, file metadata, and IDS alerts. The data were split into training and testing blocks to evaluate the capacity of the proposed model to generalize in real-world forensics. Several Data on performance accuracy, precision, recall, and F1-score were employed to assess the capability of the system to detect malicious activities, match forensic artefacts, and assist the digital investigation workflow.
TABLE 1: Sample Forensic Artefacts Extracted from System and Network Logs
Artefact Type | Description | Example Indicators |
Process Logs | Records of process creation, termination, memory usage | Suspicious parent–child process chain, privilege escalation |
Network Traffic | Packet flow statistics and connection metadata | Abnormal ports, high outbound traffic, C2 server indicators |
File Metadata | Access, modification, deletion patterns | Unauthorized file encryption, high-entropy payloads |
Registry Events | System configuration changes | Persistence mechanisms, startup modifications |
IDS Alerts | Triggered security rules | DDoS, port scanning, exfiltration attempts |
TABLE 2: Summary of Performance Metrics for Forensic Detection Models
Model | Accuracy | Precision | Recall | F1-Score |
Logistic Regression | 82.15% | 0.79 | 0.74 | 0.76 |
SVM | 84.92% | 0.82 | 0.78 | 0.80 |
Random Forest | 88.34% | 0.86 | 0.84 | 0.85 |
Proposed Hybrid Framework | 94.57% | 0.92 | 0.91 | 0.91 |
Fig 2: Accuracy Comparison of Forensic Detection Models
Fig 3: Precision vs Recall Comparison
The paper is a proposal of a Hybrid AI-based Forensic Intelligence Framework that would enhance the accuracy, scalability and reliability of real-time digital evidence analysis in sophisticated cyber conditions. The framework allows efficient heterogeneous processing of forensic data, automated extraction and classification of features, and better threat detection and less false alarms by combining machine learning, deep learning, and explainable AI. It has been shown that results with experiments are better than the traditional ones in the metrics of accuracy and F1-score. This can be improved by more sophisticated models such as graph neural networks and transformer architectures, and edge-based real-time analytics, which can enhance identification of sophisticated attacks and allow real-time low-latency forensic investigations.