ICACT20260079 Question.1
Questioner: md02anas02@gmail.com 2026-02-09 오전 3:37:19 |
ICACT20260079 Answer.1
Answer by Auhor juniorokangondoloshima@esp.sn 2026-02-09 오전 3:37:19
Chrome  Click!! |
| What is the main goal of your proposed Android forensic framework? |
The main goal of the proposed Android forensic framework is to establish a real-time, operational platform for the collection, analysis, and exploitation of digital artefacts from Android devices while ensuring evidence integrity and forensic reliability. This framework aims to support law enforcement agencies in African countries by enabling rapid detection of suspicious activities and improving investigative decision-making, even in resource-constrained environments. |
ICACT20260079 Question.2
Questioner: md02anas02@gmail.com 2026-02-09 오전 3:38:25 |
ICACT20260079 Answer.2
Answer by Auhor juniorokangondoloshima@esp.sn 2026-02-09 오전 3:38:25
Chrome Click!! |
| Did you test your method on real Android devices or only on simulated data? |
The proposed method was evaluated using real Android data, complemented by controlled experimental scenarios. Real-world artefacts extracted from Android devices were used to validate the practicality, reliability, and forensic relevance of the framework, while simulated or controlled data were employed to ensure repeatability and to assess specific components under well-defined conditions. This combination allows the framework to reflect realistic investigation settings while maintaining experimental rigor. |
ICACT20260079 Question.3
Questioner: hhl9438@chungbuk.ac.kr 2026-02-09 오후 5:26:21 |
ICACT20260079 Answer.3
Answer by Auhor juniorokangondoloshima@esp.sn 2026-02-09 오후 5:26:21
Chrome Click!! |
| For network anomaly detection using Autoencoders, how do you determine the reconstruction error threshold? Is it static, or does it adapt dynamically to different network environments (e.g., Wi-Fi vs. LTE)? |
The reconstruction error threshold of the autoencoder is not defined arbitrarily, but is empirically determined based on the distribution of errors observed during the training and validation phases on legitimate network flows. We adopt an adaptive strategy: through incremental learning and the continuous integration of data collected under real-world conditions, the model progressively refines its representation of normal traffic, allowing the effective threshold to dynamically adapt to different network environments, such as Wi-Fi or LTE, while maintaining a low false positive rate and stable performance. |
ICACT20260079 Question.4
Questioner: hripsime.hovhannisyan@rau.am 2026-02-10 오후 4:54:34 |
ICACT20260079 Answer.4
Answer by Auhor juniorokangondoloshima@esp.sn 2026-02-10 오후 4:54:34
Chrome Click!! |
| Did you observe any specific drop in accuracy or "forgetting" of certain malware classes after the pruning and quantization process? |
Based on our experiments, we did not observe any significant “catastrophic forgetting” of specific malware classes after pruning and quantization. The optimizations led to only a marginal and controlled reduction in performance, while class-wise precision and recall remained well balanced across malware families. This stability is mainly due to the hybrid multimodal fusion (CNN–LSTM–Autoencoder) and the use of transfer learning and incremental learning, which help preserve discriminative features even after model compression. As a result, the optimized model maintains high accuracy (94.8%) and a low false positive rate (3.8%) in real-world conditions, demonstrating that pruning and quantization improved efficiency without degrading class-level detection capability |
ICACT20260079 Question.5
Questioner: hripsime.hovhannisyan@rau.am 2026-02-10 오후 4:56:56 |
ICACT20260079 Answer.5
Answer by Auhor juniorokangondoloshima@esp.sn 2026-02-10 오후 4:56:56
Chrome Click!! |
| What specific explainability tools or techniques did you integrate into the framework to ensure a digital forensic investigator could explain a "malicious" verdict? |
In our framework, we integrated SHAP and LIME as the main explainability techniques to support forensic analysis. SHAP is used to quantify the contribution of individual features (permissions, system calls, network flows) to a malicious decision, providing both global and class-level interpretability, while LIME offers local explanations by approximating the model’s behavior around a specific sample. Together, these tools allow a digital forensic investigator to trace a malicious verdict back to concrete artifacts and behaviors, ensuring transparency, reproducibility, and compliance with medico-legal requirements in digital investigations |
