Collaborative Research: Education DCL: EAGER: Harnessing the Power of Large Language Models in Digital Forensics Education at MSI and HBCU

The escalating threat of cybercrime has underscored the urgent need for skilled professionals proficient in collecting and presenting evidence for legal proceedings and business decision-making. However, the vast volume of digital data stored across devices, networks, and social media platforms makes it challenging to locate and analyze specific pieces of evidence. The task of connecting evidence and identifying patterns presents a daunting challenge for human investigators. The novelty of this project lies in harnessing the extraordinary capabilities of Large Language Models (LLMs) to create tailored educational materials for digital forensics professionals and students. These materials are designed to equip investigators with the knowledge and skills necessary to navigate the intricate landscape of cybercrimes and enhance their effectiveness in combating such offenses. The project's broader significance is to better prepare investigators to leverage LLM-assisted techniques for digital forensics, ensuring they can adapt to the evolving nature of cyber threats effectively. The project will fine-tune an LLM to construct Digital Forensic Investigation Graphs (DFIGs) based on criminal cases from a widely recognized repository. These DFIGs serve as visually informative representations of the investigation process, evidence entities, and their interconnections using STIX, a standardized language for exchanging structured threat intelligence data. To ensure accuracy, the entities and relationships within the graphs will undergo scrutiny through graph neural network (GNN) models, identifying and rectifying potential errors. Supported by comprehensive instructional materials, including lecture notes, case studies, and hands-on lab exercises, students will be guided through the process of acquiring the necessary expertise to construct and analyze DFIGs for diverse digital forensic cases. This will promote digital forensics education at the University of Baltimore, a Minority-Serving Institution, and Florida A&M University, an HBCU, among others. Additionally, a faculty development workshop will disseminate the instructional materials to the broader national community, fostering a stronger and more inclusive network of cybercrime fighters. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.