Collaborative Research: Education DCL: EAGER: Harnessing the Power of Large Language Models in Digital Forensics Education at MSI and HBCU

不断升级的网络犯罪威胁凸显了对熟练的专业人员的迫切需求，这些专业人员能够为法律诉讼和商业决策收集和提供证据。然而，存储在设备、网络和社交媒体平台上的大量数字数据使得定位和分析特定证据具有挑战性。对人类调查人员来说，连接证据和识别模式的任务是一项艰巨的挑战。这个项目的新颖之处在于利用大型语言模型（llm）的非凡能力，为数字取证专业人员和学生创建量身定制的教育材料。这些材料旨在为调查人员提供必要的知识和技能，以应对错综复杂的网络犯罪，并提高他们打击此类犯罪的效率。该项目的更广泛意义在于帮助调查人员更好地利用法学硕士辅助技术进行数字取证，确保他们能够有效地适应不断变化的网络威胁。该项目将对法学硕士进行微调，以基于广泛认可的存储库中的刑事案件构建数字法医调查图（DFIGs）。这些dfig使用STIX（一种用于交换结构化威胁情报数据的标准化语言）作为调查过程、证据实体及其相互联系的可视化信息表示。为了确保准确性，图中的实体和关系将通过图神经网络（GNN）模型进行审查，识别和纠正潜在的错误。在全面的教学材料的支持下，包括课堂讲稿、案例研究和动手实验练习，学生将被引导通过获取必要的专业知识来构建和分析各种数字法医案件的DFIGs。这将促进巴尔的摩大学（少数族裔服务机构）和佛罗里达农工大学（HBCU）等机构的数字取证教育。此外，教师发展研讨会将向更广泛的国家社区传播教学材料，培养一个更强大、更具包容性的网络犯罪打击网络。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The escalating threat of cybercrime has underscored the urgent need for skilled professionals proficient in collecting and presenting evidence for legal proceedings and business decision-making. However, the vast volume of digital data stored across devices, networks, and social media platforms makes it challenging to locate and analyze specific pieces of evidence. The task of connecting evidence and identifying patterns presents a daunting challenge for human investigators. The novelty of this project lies in harnessing the extraordinary capabilities of Large Language Models (LLMs) to create tailored educational materials for digital forensics professionals and students. These materials are designed to equip investigators with the knowledge and skills necessary to navigate the intricate landscape of cybercrimes and enhance their effectiveness in combating such offenses. The project's broader significance is to better prepare investigators to leverage LLM-assisted techniques for digital forensics, ensuring they can adapt to the evolving nature of cyber threats effectively. The project will fine-tune an LLM to construct Digital Forensic Investigation Graphs (DFIGs) based on criminal cases from a widely recognized repository. These DFIGs serve as visually informative representations of the investigation process, evidence entities, and their interconnections using STIX, a standardized language for exchanging structured threat intelligence data. To ensure accuracy, the entities and relationships within the graphs will undergo scrutiny through graph neural network (GNN) models, identifying and rectifying potential errors. Supported by comprehensive instructional materials, including lecture notes, case studies, and hands-on lab exercises, students will be guided through the process of acquiring the necessary expertise to construct and analyze DFIGs for diverse digital forensic cases. This will promote digital forensics education at the University of Baltimore, a Minority-Serving Institution, and Florida A&M University, an HBCU, among others. Additionally, a faculty development workshop will disseminate the instructional materials to the broader national community, fostering a stronger and more inclusive network of cybercrime fighters.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.