AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation

AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation

Speakers: Akila Wickramasekara (Doctoral researcher, University College Dublin)

Conference: DFDS

YouTube: https://www.youtube.com/watch?v=-WuP47jHJoY

Overview

In the rapidly evolving landscape of digital forensics, the sheer volume of digital evidence necessitates increasingly efficient and automated solutions. Akila Wickramasekara, a doctoral researcher at University College Dublin, presented "AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation" at the DFDS conference, addressing a critical challenge: the reliable integration of Large Language Models (LLMs) into forensic workflows. This talk introduces AutoDFBench, an innovative, open-source benchmarking framework designed to rigorously test and evaluate the accuracy and reliability of AI-generated digital forensic code and tools.

The core motivation behind this research stems from the growing need to provide more accessible forensic tools for non-technical investigators, reduce manual effort, and enhance overall efficiency in investigations. While LLMs offer immense potential for automation across various forensic phases—from evidence categorization to report generation—their outputs, particularly generated code, must be validated with uncompromising accuracy. AutoDFBench directly confronts this validation problem by establishing a systematic methodology for measuring the precision and reliability of LLM-generated forensic artifacts, leveraging established standards like those from the NIST Computer Forensic Tool Testing (CFTT) Program.

This framework is not merely an academic exercise; it represents a crucial step towards safely and effectively integrating AI into the sensitive domain of digital forensics. By providing a transparent and reproducible method for evaluating AI performance, AutoDFBench aims to build confidence in AI-assisted tools while also highlighting their current limitations. Wickramasekara’s work underscores that while AI promises to revolutionize forensic investigations, a critical, data-driven approach to its implementation is paramount to uphold the integrity and trustworthiness of digital evidence.

Background

▶ Watch: Introduction and PhD Motivation (0:00)

The genesis of the AutoDFBench framework lies within Akila Wickramasekara’s PhD research, driven by the escalating demands placed on digital forensic investigators. The exponential growth of digital evidence necessitates more efficient and automated solutions to manage workloads, a need compounded by the desire to make forensic investigations more accessible to non-technical personnel. By reducing manual effort, the overall efficiency of forensic investigations can be significantly improved, allowing human experts to focus on complex analytical tasks rather than repetitive, time-consuming processes.

Wickramasekara’s PhD objectives are multifaceted: exploring the potential of LLMs in digital forensic investigations, establishing methodologies for designing and enhancing the performance of these LLMs, and ultimately evaluating the effectiveness and advantages of AI-assisted frameworks. To contextualize the role of LLMs, the speaker introduced a "potentiality matrix" across the five traditional phases of digital forensics: collection, preservation, examination, analysis, and reporting. While collection was deemed to have lower LLM potential due to the high need for human involvement (though LLMs could assist with evidence categorization), preservation showed medium potential, envisioning AI agents automating tasks like disk imaging and hashing. The examination, analysis, and reporting phases, however, were identified as having high potential. For instance, LLMs could revolutionize examination through keyword searching, file recovery, and pattern matching; enhance analysis via evidence interpretation, timeline analysis, and semantic analysis; and streamline reporting through automated report generation and evidence summarization.

Despite this high potential, several challenges emerged that LLMs are uniquely positioned to address: reducing investigation time, alleviating workload burdens, and increasing accessibility for a broader range of investigators. The research then narrowed its focus specifically to the examination phase, particularly the generation and execution of digital forensic code. This focus immediately highlighted a critical problem: how to accurately measure the validity and reliability of AI-generated forensic code. Key questions arose: How can the accuracy of generated code be measured? How valid are the output results? What parameters should be used for validation? Without robust answers, the integration of LLMs into forensic practice would be severely hampered by trust and reliability concerns.

To address these fundamental validation challenges, Wickramasekara turned to established methodologies, specifically the NIST Computer Forensic Tool Testing (CFTT) Program. The CFTT program, developed by the National Institute of Standards and Technology (NIST), provides a standardized methodology for testing digital forensic tools to ensure their reliability and accuracy. NIST CFTT covers critical task areas such as disk imaging, string search, file recovery, mobile forensics, cloud data extraction, and memory forensics. The program employs standardized test cases and rigorous testing protocols to verify the efficiency and accuracy of forensic tools. By aligning AutoDFBench with NIST CFTT principles, the framework gains a crucial foundation of credibility and an objective benchmark against which AI-generated code can be evaluated, mitigating the risks associated with blindly trusting AI outputs in sensitive forensic contexts.

Key Findings

▶ Watch: Problem: Validating AI-Generated Forensic Code (3:00)

The primary contribution of this research is the design and implementation of AutoDFBench, an open-source benchmarking framework specifically tailored for AI-generated digital forensic code and tool evaluation. This framework is publicly available on GitHub, inviting community scrutiny and collaboration.

A significant aspect of the research involved testing AutoDFBench with five state-of-the-art LLMs, subjecting them to an extensive battery of 24,200 unique tests. The results of this comprehensive testing yielded a crucial insight: the current accuracy of LLM-generated digital forensic code is remarkably low. This finding serves as a stark warning, emphasizing that digital forensic practitioners should not blindly trust LLM outputs without independent verification. While the results underscore the need for further LLM refinement, they also validate the necessity and reliability of the AutoDFBench framework itself, demonstrating its capability to consistently measure and highlight these performance gaps.

Further analysis of the test results revealed the critical importance of detailed prompting (often referred to as prompt engineering). The experiments compared "beginner prompts" (simple, less specific instructions) with "advanced prompts" (more detailed, context-rich instructions). Advanced prompts consistently led to significantly higher "hits" or correct outcomes compared to beginner prompts, highlighting that the quality of LLM output is heavily dependent on the specificity and clarity of the input query. For instance, in string search tasks, advanced prompts dramatically outperformed beginner prompts in generating useful code.

While the overall scores for LLM-generated code were low (e.g., a perfect hit count of 73,840 was rarely approached, with top LLMs achieving only around 7,264 hits in some scenarios), the framework successfully provided quantifiable metrics like the AutoDFBench score (derived from F1 scores). These metrics, despite reflecting current LLM limitations, demonstrated the framework's ability to reliably benchmark and compare different LLMs and prompt strategies. The sheer scale of the experiment—24,200 tests taking approximately 980 hours to complete—underscores the rigor and thoroughness of the validation process, confirming AutoDFBench's robustness as a testing tool. These findings collectively establish AutoDFBench as an indispensable tool for guiding the responsible development and deployment of AI in digital forensics.

Technical Deep Dive

▶ Watch: AutoDFBench Framework Design & Evaluation Score (5:50)

The AutoDFBench framework is meticulously designed with several key considerations to ensure its versatility, accuracy, and extensibility. It is configurable and extensible, meaning its parameters can be adjusted to support a wide array of testing environments and scenarios. This flexibility allows it to adapt to different forensic tools, data types, and investigation contexts. Crucially, the framework is LLM and architecture agnostic, capable of integrating with various types of LLMs—whether they are local models running on a private infrastructure (e.g., Llama 3) or online, cloud-based services (e.g., GPT-4, Claude 3.5 Sonnet). This agnosticism ensures that AutoDFBench remains relevant as LLM technology continues to evolve.

A cornerstone of AutoDFBench's design is its commitment to ground truth validation. This is achieved by leveraging the NIST Computer Forensic Tool Testing (CFTT) Program's analysis, test data, and accuracy checks. By aligning with NIST standards, the framework ensures that the evaluation of AI-generated code is based on established, industry-recognized benchmarks for reliability and accuracy. To quantify performance, AutoDFBench incorporates a robust performance scoring mechanism, calculating precision, recall, and F1 scores. These metrics are then aggregated to produce the unique AutoDFBench score, providing a comprehensive and objective measure of an LLM's proficiency in generating forensic code.

The AutoDFBench framework operates through four distinct, sequential phases:

1. API Handling: This initial phase is responsible for retrieving job details, which encapsulate the specific forensic task or query to be performed. It then interacts with the chosen LLM via its API to generate a response, which typically includes the requested digital forensic code.
2. Code Preparation: Once the LLM generates a textual response, this phase meticulously extracts the actual code snippet from the surrounding natural language text. This ensures that only the executable code is isolated for subsequent processing.
3. Code Execution: In this critical phase, the extracted code is executed as an executable file within a controlled environment. The framework captures both the outputs (results) and any errors generated during execution. These results are then stored in a database for later analysis.
4. Summary and Evaluation: The final phase involves comparing the results obtained from the code execution against the predefined NIST CFTT ground data. This comparison is used to calculate the performance metrics (true positives, false positives, false negatives) and subsequently derive the precision, recall, and F1 scores. The average F1 score across relevant test subsets culminates in the final AutoDFBench score, providing a quantitative measure of the LLM's accuracy.

The calculation of the AutoDFBench score is central to the framework's evaluation methodology. It is derived from fundamental classification metrics:

• True Positives (TP): Instances where the test results correctly match the expected outcomes as defined by the NIST CFTT ground data for specific test cases.
• False Positives (FP): Instances where the test results indicate a hit or an outcome that does not align with the ground truth.
• False Negatives (FN): Instances where an expected outcome from the ground truth was not identified or produced by the executed code.

From these counts, precision (TP / (TP + FP)) and recall (TP / (TP + FN)) are calculated. Precision measures the proportion of positive identifications that were actually correct, while recall measures the proportion of actual positives that were correctly identified. The F1 score, which is the harmonic mean of precision and recall (2 (Precision Recall) / (Precision + Recall)), is then computed for each subset of test cases. The final AutoDFBench score is the average F1 score across all calculated subsets, offering a balanced measure that accounts for both false positives and false negatives, providing a comprehensive assessment of the LLM's code generation accuracy.

Demo / Proof of Concept

▶ Watch: Proof of Concept Experiment Setup (8:00)

The proof of concept for AutoDFBench involved a large-scale experiment designed to rigorously test various LLMs against digital forensic tasks. The setup utilized a hybrid approach, incorporating both local and external LLMs. For local LLMs, Llama 3, StarCoder, and WaveCoder were deployed using Lamadoers, with each LLM running in separate Docker containers to ensure isolated and consistent environments. For external, cloud-based LLMs, GPT-4 and Claude 3.5 Sonnet were integrated via an LLM library, showcasing the framework's LLM-agnostic design.

The experiment was built around a comprehensive set of test cases derived from real-world forensic scenarios. These included Windows and Linux disk images, with 62 distinct test cases for Windows environments and 59 for Linux. To ensure statistical robustness, each unique test was subjected to 10 multiple runs. The input prompts were categorized into two main types: "beginner prompts," simulating queries from a novice investigator, and "advanced prompts," reflecting the detailed and specific instructions an experienced investigator might provide. The LLMs were tasked with generating both Python code and Batch code for these forensic tasks. In total, this extensive setup resulted in a staggering 24,200 individual tests.

The experimental flow was carefully orchestrated:

1. Natural Language Query Generation: Initial natural language queries were created, with assistance from GPT to ensure a broad range of similar queries. These queries then underwent human evaluation to refine their quality and relevance.
2. Data Storage: The refined queries were saved into a CSV file, serving as the input for the AutoDFBench framework.
3. API Handling: The framework's API handling phase ingested these queries, combining them with the specified "beginner" or "advanced" base prompts. These combined prompts were then dispatched to the selected LLM.
4. LLM Response and Code Extraction: The LLM generated a textual response, which often contained both explanatory text and the requested code. The code preparation phase meticulously extracted the relevant code snippet, creating a dedicated code file.
5. Code Execution: This generated code file was then executed in a controlled environment. The execution phase captured all outputs, results, and any errors encountered, storing them in a database.
6. Summary Generation and Evaluation: Finally, the summary generation phase took the execution results and compared them against the NIST CFTT ground data. This comparison allowed for the calculation of true positives, false positives, and false negatives, which were then used to determine the F1 scores for each test, ultimately contributing to the overall AutoDFBench score.

The results of the string search tests provided particularly illustrative insights. A key finding was the importance of detailed prompts. Advanced prompts consistently yielded a significantly higher number of "hits" (correctly identified strings) compared to beginner prompts. For example, Claude 3.5 Sonnet achieved 7,264 hits with various prompts, while Llama 3 managed only 660 total hits. It is critical to note that the theoretical "perfect hit count" for these tests was 73,840, indicating that even the best-performing LLMs are currently far from achieving optimal accuracy in generating forensic code.

While the raw AutoDFBench scores (representing average F1 scores) were generally low across all LLMs, this outcome was presented not as a failure of the LLMs, but as a validation of the framework's reliability. The framework successfully produced quantifiable results for all 24,200 tests, a process that consumed approximately 980 hours. The discussion also touched upon the concept of a "best performing run," highlighting that the framework captures and reports the highest F1 score achieved across the multiple runs for a given test case. This extensive proof of concept successfully demonstrated AutoDFBench's capability to systematically benchmark LLM performance in digital forensics, while simultaneously underscoring the current limitations of AI in reliably generating forensic code.

Defensive Implications

▶ Watch: Future Work and PhD Goals (12:00)

The findings from the AutoDFBench research carry significant defensive implications for digital forensic practitioners and organizations. The most immediate and critical takeaway is the unequivocal message: do not blindly trust AI-generated forensic code or outputs. The current low accuracy rates observed across multiple state-of-the-art LLMs, even with advanced prompting, underscore that these models are not yet reliable enough for unsupervised use in sensitive forensic investigations. Relying solely on AI-generated code could lead to missed evidence, misinterpretations, or even compromised integrity of an investigation, potentially having severe legal and operational consequences.

Instead, the research emphasizes the critical need for rigorous validation of any AI-assisted tools or code before their deployment in real-world scenarios. AutoDFBench provides a blueprint for how such validation should be conducted, leveraging established standards like those from the NIST CFTT Program. Defenders should adopt similar structured testing methodologies to verify the efficacy and accuracy of any AI-driven solutions they consider integrating into their workflows. This means establishing internal testing frameworks, conducting extensive proof-of-concept trials, and maintaining a healthy skepticism towards AI outputs.

Furthermore, these findings highlight the continued importance of human expertise and skill retention within digital forensics. While AI can undoubtedly assist in automating mundane tasks and improving efficiency, the role of the experienced investigator remains paramount. Investigators need to possess the deep technical skills necessary to critically evaluate, verify, and, if necessary, correct AI-generated code or analysis. They must understand the underlying forensic principles and the limitations of AI to effectively oversee and validate its contributions. AI should be viewed as an assistant, not a replacement, for human judgment and expertise.

Looking ahead, while current LLM performance in code generation is low, the potential for AI to significantly enhance efficiency and accessibility in digital forensics remains. AutoDFBench serves as a foundational step towards realizing this potential safely. By providing an open-source benchmarking framework, it empowers the community to collaboratively improve and scrutinize AI-generated forensic code. Defenders can utilize or contribute to such frameworks to drive the development of more accurate and trustworthy AI models. This proactive engagement is crucial for guiding the responsible evolution of AI in digital forensics, ensuring that future advancements truly augment human capabilities without introducing unacceptable risks. Ultimately, the defensive posture must be one of informed caution, continuous validation, and a strategic integration of AI that prioritizes accuracy and integrity above all else.

Key Takeaways

• LLMs hold significant potential for enhancing digital forensic investigations, particularly in the examination, analysis, and reporting phases, by automating tasks and improving accessibility.
• The AutoDFBench framework offers a robust, open-source, and LLM-agnostic methodology for benchmarking AI-generated digital forensic code against established NIST Computer Forensic Tool Testing (CFTT) Program standards.
• Current LLM performance in generating accurate digital forensic code is significantly low, with even state-of-the-art models failing to achieve high hit counts, underscoring the critical need for human oversight and validation.
• Prompt engineering is a crucial factor influencing LLM output quality; advanced, detailed prompts consistently yield better results than simple, beginner-level instructions.
• The framework's design, incorporating configurable parameters, ground truth validation, and F1-score-based performance scoring, ensures its reliability and extensibility for diverse testing environments.
• Automated, rigorous testing frameworks like AutoDFBench are indispensable for safely and effectively integrating AI into digital forensics, preventing blind trust in AI outputs and upholding the integrity of investigations.

About the Speaker(s)

Akila Wickramasekara is a doctoral researcher at University College Dublin. His research is focused on exploring the potential of Large Language Models (LLMs) in digital forensic investigations. Specifically, his work involves establishing methodologies for designing and enhancing the performance of LLMs and evaluating the effectiveness of AI-assisted frameworks in this domain. His presentation on AutoDFBench exemplifies his commitment to developing rigorous, data-driven approaches for integrating AI safely and effectively into digital forensics.