A Symbolic-Neural Framework for Context-Aware Evidence Extraction from Mobile SQLite Databases
Jeel Piyushkumar Khatiwala, Divyangkumar Patel, Dianxiang Xu, Weifeng Xu
Abstract
Reliable forensic evidence extraction from mobile SQLite databases is challenging because application schemas are undocumented, evolve across releases, and differ across operating systems, making schema-specific methods brittle and difficult to maintain. We present SNEEF, a symbolic-neural framework for context-aware evidence extraction that encodes each SQLite row as context-value pairs with standardized provenance metadata and column labels, uses a language model to recognize nine forensic entity types, and binds each accepted entity to its source table and row through the PA-EEP provenance protocol. We evaluate SNEEF against examiner-verified ground truth from five corpora built from public Android and iOS device images, spanning multiple application versions. SNEEF achieves an F1 score of 0.967 for evidence entities extracted from SQLite row content, excluding application names, compared with 0.728 for a context-free configuration, with consistent gains across all corpora. We also introduce an Evidence Failure Mode taxonomy to characterize why extraction errors occur.
Create a lesson
Related papers
Bilateral Protection for Private LoRA Inference with Intel TDX
Xiaodong Li, Mingyuan Ma, Dongbo Yan
Can Benign Skills Induce Misaligned Behavior in LLM Agents?
Xuanye Zhang, Yongsen Zheng, Kaiyu Zhou et al.
The Native Menace: Host-to-Browser Cross-Boundary Attacks via Native Messaging
Jyotirmay Chauhan, Rownak Islam, Jason Polakis
When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation
Qinghua Mao, Xi Lin, Yuxin Qi et al.
VerfGraph: Efficient Zero-Knowledge Verifiable Graph Query Evaluation System
Tianyi Ma, Yuncong Zhang, Yuanzhuo Yu et al.
ScrambleMark: Zero-Query Watermark-Agnostic Black-Box Evasion of Modern Speech Watermarking
Binhao Ma, Weikang Ding, Hanqing Guo et al.