Cybersecurity-Driven Machine Learning Approaches for The Web Browser Digital Forensics: A ‎Comparative AnalysisOf Classification Performances on Browser Artifact Data

  • Authors

    • Richard Nkrumah Department of Applied Mathematics and Statistics, Accra Technical University https://orcid.org/0000-0002-2308-7650
    • Edwin Mends-Brew Department of Applied Mathematics and Statistics, Accra Technical University
    • Asante Michael Department of Computer Science, Kwame Nkrumah University of Science and Technology
    • Yeboah Andrews Murphy Department of Applied Mathematics and Statistics, Accra Technical University
    • Osei Antwi Department of Applied Mathematics and Statistics, Accra Technical University
    • Angela Nkrumah Ghana Health Service
    • Henry Amoako ‎ Mante Accra Institute of Technology
    https://doi.org/10.14419/786rgw50

    Received date: November 19, 2025

    Accepted date: February 9, 2026

    Published date: February 18, 2026

  • Cybersecurity; Machine Learning; Linear Discriminant Analysis; Digital Forensics; Browser Artefacts

  • Abstract

    Selecting a machine learning algorithm with optimal precision, accuracy, and recall has been a major challenge in cybersecurity and digital ‎forensic analysis. Common challenges include difficulty in impact visualization, deterioration in efficiency when datasets are large, the discretized nature of datasets, complex relationships among variables, linearity assumptions, overfitting, and other related issues. In an attempt ‎to mitigate these challenges in practice, this study aims to compare the classification performance of machine learning algorithms applied to ‎web browser extracts in digital forensics. Consequently, the most efficient algorithm is proposed for forensic analysis. The study utilized ‎data from 20 computers, each installed with web browsers including Microsoft Internet Explorer, Microsoft Edge, Google Chrome, Mozilla ‎Firefox, and Opera. Browser extracts were obtained using the Web Browser Forensic Analyzer (WEFA) tool (version 1.2). Browser artefacts were extracted and categorized into history, cache, cookies, typed URLs, sessions, most visited sites, screenshots, downloaded files, ‎favorites, bookmarks, and thumbnails. The dataset consisted of counts of artefacts extracted from the browsers. Data collection was further ‎supported by Firefox Forensic Analyzer and Google Chrome Analyzer tools. The Python programming language was used as the primary ‎tool for implementing and evaluating the performance of the machine learning algorithms. During the implementation process, the study ‎assessed the performance of the Linear Discriminant Algorithm against five competing classification algorithms: Logistic Regression, Decision Tree Classifier, K-Nearest Neighbors, Naive Bayes Classifier, and Support Vector Classifier. The findings revealed that the Linear ‎Discriminant Algorithm outperformed the competing algorithms in terms of accuracy, precision, recall, and F1-score. The study therefore ‎concludes that the Linear Discriminant Algorithm is an enhanced and effective approach for classifying browser extracts (artefacts) in digital ‎forensic investigations‎.

  • References

    1. Andrew, M., Ibrahim, B., and Talal A. I. (2012). Portable web browser forensics: A forensic examination of the privacy benefits of portable web browsers, 2012 International Conference on Computer Systems and Industrial Informatics, 18-20 Dec. 2012.
    2. Junghoon, O., Seungbong, L. (2011). Advanced evidence collection and analysis of web browser activity, Elsevier - Digital Investigation, Volume 8, Supplement, August 2011, Pages S62-S70. https://doi.org/10.1016/j.diin.2011.05.008.
    3. Peter., E., (2010). How Unique is Your Web Browser? In Proceedings of the 10th International Conference on Privacy Enhancing Technologies (PETS’10). Springer-Verlag, Berlin, Heidelberg, 1–18. https://doi.org/10.1007/978-3-642-14527-8_1.
    4. Gábor. G., Gulyás, D., Francis S., Nataliia B., and Claude C. (2018). To Extend or not to Extend: on the Uniqueness of Browser Extensions and Web Logins. In 2018 Workshop on Privacy in the Electronic Society (WPES’18). ACM, 14–27. https://doi.org/10.1145/3267323.3268959.
    5. Donny, J., O,. Narasimha and Shashidhar (2013), Do private and portable web browsers leave incriminating evidence?: a forensic analysis of resid-ual artifacts from private and portable web browsing sessions, EURASIP Journal on Information Security, December 2013, 2013:6. https://doi.org/10.1186/1687-417X-2013-6
    6. Huwida Said, Noora Al Mutawa and Ibtesam Al Awadhi, Forensic analysis of private browsing artefacts, 2011 International Conference on Inno-vations in Information Technology, 25-27 April 2011. https://doi.org/10.1109/INNOVATIONS.2011.5893816.
    7. Rami, M. A., Mohammad M., Alqahtani (2019) A comparison of machine learning techniques for file system forensics analysis. Journal of Infor-mation Security and Applications 46 (2019) 53–61. https://doi.org/10.1016/j.jisa.2019.02.009.
    8. Ankit Agarwal, Megha Gupta, Saurabh Gupta & S.C. Gupta. (2011). Systematic Digital Forensic Investigation Model, International Journal of Computer Science and Security (IJCSS). Volume (5). Issue (1).
    9. Faheem M., Kechadi MT., Le-Khac NA. (2016), Toward a new mobile cloud forensic framework 6th IEEE International Conference on Innovative Computing Technology, Ireland, 2016. https://doi.org/10.1109/INTECH.2016.7845142.
    10. Brown, M., Lary, D., Vrieling, A., Stathakis, D., & Mussa, H. (2008). Neural networks as a tool for constructing continuous NDVI time series fromAVHRR and MODIS. International Journal of Remote Sensing, 29(24), 7141–7158. https://doi.org/10.1080/01431160802238435.
    11. Sadilek, A., Kautz, H. and Bigham, J.P. (2012) Finding Your Friends and Following Them to Where You Are. Proceedings of the Fifth ACM In-ternational Conference on Web Search and Data Mining, Seattle, 8-12 February 2012, 723-732. https://doi.org/10.1145/2124295.2124380.
    12. Zhang, R. Hu,Z. Pan,G. and Wang,Y. (2016).‘‘Robust discriminative nonnegative matrix factorization,’’ Neurocomputing, vol. 173, pp. 552–561. https://doi.org/10.1016/j.neucom.2015.07.032.
    13. Devi Prasad bhukya and S. Ramachandram (2010)“ Decision tree induction- An Approach for data classification using AVL –Tree”, International journal of computer and electrical engineering, Vol. 2, no. 4. https://doi.org/10.7763/IJCEE.2010.V2.208.
    14. Gupta, N.A. (2017). Literature Survey on Artificial Intelligence. https://www.ijert.org/research/aliterature-survey-on-artificial-intelligence IJERTCONV5IS19015.pdf (accessed on 7 January 2020).).
    15. Raghavan S. and Raghavan S. V. (2013). AssocGEN: Engine for Analyzing Metadata Based Associations in Digital Evidence, In Proceedings of the 2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE), IEEE 978-1-4799-4061-5, Hong Kong, China, Nov 21-22, 2013. https://doi.org/10.1109/SADFE.2013.6911541.
    16. Pierre L., Gildas A, Benoit B., and Nick N. (2019). Morellian Analysis for Browsers: Making Web Authentication Stronger with Canvas Finger-printing. In Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19-20, 2019, Proceedings. 43–66. https://doi.org/10.1007/978-3-030-22038-9_3.
    17. Artificial Intelligent and Cyber security Institute (AICSI) Ghana (2020). Department of Forensic.
    18. Kok, S. H., Azween, A., & Jhanjhi, N. Z. (2020). Evaluation metric for crypto-ransomware detection using machine learning. Journal of Infor-mation Security and Applications, 55, 102646. https://doi.org/10.1016/j.jisa.2020.102646.

  • Downloads

  • How to Cite

    Nkrumah , R. ., Mends-Brew , E. ., Michael , A. ., Murphy , Y. A. ., Antwi , O. ., Nkrumah , A. ., & Mante , H. A. ‎. (2026). Cybersecurity-Driven Machine Learning Approaches for The Web Browser Digital Forensics: A ‎Comparative AnalysisOf Classification Performances on Browser Artifact Data. Journal of Advanced Computer Science & Technology, 13(1), 1-10. https://doi.org/10.14419/786rgw50