1. Bayesian Networks for Cyber Crimes

2. Bayes’ Theorem For an hypothesis H supported by evidence E: Pr(H|E) = Pr(E|H).Pr(H)/Pr(E) where – Pr(H|E) is the posterior probability of H, given E – Pr(E|H) is the likelihood of E, given H – Pr(H) is the prior probability of H, without E – Pr(E) is a normalisation factor We can use Pr(H)=½ for a zero bias on H We can get Pr(E|H) from surveys of experts

3. Odds and Likelihood Ratio

4. Bayesian Networks Introduced by Judea Pearl in 1988 Enables the Bayesian inference to propagate through a network (DAG) representing the evidential traces (Ei) and the associated sub- hypotheses (Hi) of a digital crime model Output is posterior probability of hypothesis H Example: BitTorrent illegal P2P MP4 uploading (‘initial seeder’) case