Quantifying Association Between Discrete Event Time Series

• Activity Number: 291 - Statistical Applications in Forensic Evidence
• Type: Topic Contributed
• Date/Time: Tuesday, July 31, 2018 : 8:30 AM to 10:20 AM
• Sponsor: Advisory Committee on Forensic Science
• Author(s): Christopher Galbraith* and Padhraic Smyth and Hal Stern
• Companies: University of California, Irvine and University of California, Irvine and University of California, Irvine
• Keywords: likelihood ratio; randomization; marked point process; digital forensics; cybersecurity; association

Abstract

In this paper we consider the problem of quantifying the degree of association between pairs of discrete event time series, with potential applications in forensic and cybersecurity settings. We propose two techniques: (i) a population-based approach to calculate score-based likelihood ratios when a sample from a relevant population is available, and (ii) a resampling approach to compute coincidental match probabilities when only a single pair of event series is available. Multiple different score functions are used to quantify association, including characteristics of marked point processes (coefficient of segregation and mingling index) and summary statistics for inter-event times. These methods are applied to both simulated data and to real-world data consisting of logs of computer activity over a 7 day period from 55 users. The results indicate that these techniques have considerable promise for assessing the degree of association between discrete event time series.