DFR–HCI: A forensic-ready microservice architecture for human-to-human communication-based cybercrime detection

Document Type

Article

Source of Publication

Forensic Science International Digital Investigation

Publication Date

9-1-2026

Abstract

Digital forensic readiness (DFR) has traditionally focused on infrastructure and system logs, with limited support for the linguistic and semantic signals that drive modern communication-based cybercrime in cloud-hosted SaaS platforms. This paper presents a digital forensic readiness of human-to-human communication interaction (DFR–HCI) framework, a forensic-ready microservice architecture that treats human-to-human communication as a first-class evidential source and operationalizes proactive readiness across the full cybercrime detection pipeline. Unlike prior work that either models DFR conceptually or builds stand-alone phishing/fraud classifiers, DFR–HCI framework unifies deterministic evidence acquisition, multi-level natural language processing (NLP), semantic feature transformation, supervised machine-learning detection, and tamper-evident logging within a formally specified three-phase pipeline. Core transformations are defined as mathematical functions—including the acquisition function A(M), deterministic linguistic–semantic mapping FNLP(M), and supervised scoring function S(Xu)—and implemented in a twenty-one-microservice prototype that enforces reproducibility, provenance preservation, and alignment with ISO/IEC 27,043. Experiments on a balanced 5050-message supervised corpus show strong predictive performance (micro-average ROC–AUC ≈0.97) while preserving evidential integrity through provenance-complete logs, cryptographic integrity protections, and replayable analytical workflows. These results demonstrate that DFR–HCI framework provides a practical, scalable, and legally defensible foundation for communication-aware digital forensic readiness in modern cloud ecosystems.

ISSN

2666-2825

Publisher

Elsevier BV

Volume

58

Disciplines

Computer Sciences

Keywords

Cybercrime detection, DFIR, DFR–HCI, Digital forensic readiness, Human-centric-forensic, Microservices, NLP, Potential digital evidence, SaaS

Scopus ID

105040738220

Indexed in Scopus

yes

Open Access

no

Link to Full Text

Share

COinS