{"id":"https://openalex.org/W7164358865","doi":"https://doi.org/10.48550/arxiv.2606.11565","title":"A Deterministic Forensic Preprocessing Framework for Heterogeneous Network Datasets: Formal Foundations, Implementation, and Empirical Validation","display_name":"A Deterministic Forensic Preprocessing Framework for Heterogeneous Network Datasets: Formal Foundations, Implementation, and Empirical Validation","publication_year":2026,"publication_date":"2026-06-10","ids":{"openalex":"https://openalex.org/W7164358865","doi":"https://doi.org/10.48550/arxiv.2606.11565"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.11565","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.11565","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.11565","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5054317962","display_name":"Ravi Chaudhary","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chaudhary, Ravi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136670776","display_name":"Reza Ryan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ryan, Reza","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087546771","display_name":"Nasim Ferdosian","orcid":"https://orcid.org/0000-0003-2014-1831"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ferdosian, Nasim","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017842570","display_name":"Nickson M. Karie","orcid":"https://orcid.org/0000-0001-5173-9268"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Karie, Nickson M.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138451512","display_name":"Qian Li (114642)","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Qian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9689000248908997,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9689000248908997,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.004999999888241291,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.002899999963119626,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/timestamp","display_name":"Timestamp","score":0.6499999761581421},{"id":"https://openalex.org/keywords/preprocessor","display_name":"Preprocessor","score":0.5521000027656555},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.5386999845504761},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.45509999990463257},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.42160001397132874},{"id":"https://openalex.org/keywords/schema","display_name":"Schema (genetic algorithms)","score":0.40529999136924744},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.3522999882698059},{"id":"https://openalex.org/keywords/heterogeneous-network","display_name":"Heterogeneous network","score":0.3391999900341034}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8158000111579895},{"id":"https://openalex.org/C113954288","wikidata":"https://www.wikidata.org/wiki/Q186885","display_name":"Timestamp","level":2,"score":0.6499999761581421},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6121000051498413},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.5521000027656555},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.5386999845504761},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.45509999990463257},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.42160001397132874},{"id":"https://openalex.org/C52146309","wikidata":"https://www.wikidata.org/wiki/Q7431116","display_name":"Schema (genetic algorithms)","level":2,"score":0.40529999136924744},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.35499998927116394},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.3522999882698059},{"id":"https://openalex.org/C158207573","wikidata":"https://www.wikidata.org/wiki/Q5747224","display_name":"Heterogeneous network","level":4,"score":0.3391999900341034},{"id":"https://openalex.org/C17231256","wikidata":"https://www.wikidata.org/wiki/Q5156540","display_name":"Completeness (order theory)","level":2,"score":0.3382999897003174},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.32839998602867126},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.31540000438690186},{"id":"https://openalex.org/C2777230681","wikidata":"https://www.wikidata.org/wiki/Q7923820","display_name":"Vetting","level":2,"score":0.3147999942302704},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.29829999804496765},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.2879999876022339},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.28450000286102295},{"id":"https://openalex.org/C2775948798","wikidata":"https://www.wikidata.org/wiki/Q5160261","display_name":"Conformance checking","level":5,"score":0.28279998898506165},{"id":"https://openalex.org/C92446256","wikidata":"https://www.wikidata.org/wiki/Q3306762","display_name":"Data validation","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26260000467300415},{"id":"https://openalex.org/C2778562939","wikidata":"https://www.wikidata.org/wiki/Q1298791","display_name":"Synchronization (alternating current)","level":3,"score":0.2619999945163727},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.26089999079704285},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2549000084400177},{"id":"https://openalex.org/C93361087","wikidata":"https://www.wikidata.org/wiki/Q4426698","display_name":"Data consistency","level":2,"score":0.2540000081062317}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.11565","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.11565","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.11565","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.11565","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Digital":[0],"forensic":[1,58],"investigations":[2],"increasingly":[3],"depend":[4],"on":[5],"preprocessing":[6,59,75],"heterogeneous":[7,63,129],"network":[8,64],"evidence":[9,26,51],"from":[10,135],"intrusion":[11],"detection":[12],"systems,":[13],"IoT":[14],"devices,":[15],"and":[16,22,28,81,91,100,115,132],"enterprise":[17],"traffic":[18],"logs.":[19],"Incompatible":[20],"schemas":[21],"timestamp":[23,130],"formats":[24],"hinder":[25],"correlation":[27],"timeline":[29],"reconstruction,":[30],"while":[31],"current":[32],"ad":[33],"hoc":[34],"approaches":[35],"offer":[36],"no":[37],"mechanism":[38],"to":[39,137],"verify":[40],"consistency":[41,120],"across":[42,112,121],"runs":[43],"or":[44],"analysis,":[45],"creating":[46],"reproducibility":[47],"gaps":[48],"that":[49,61],"challenge":[50],"admissibility.":[52],"This":[53],"paper":[54],"introduces":[55],"a":[56,67],"deterministic":[57],"framework":[60,72],"converts":[62],"datasets":[65],"into":[66],"reproducible":[68],"canonical":[69],"form.":[70],"The":[71],"formalises":[73],"three":[74],"transformations:":[76],"schema":[77],"normalisation,":[78,80],"temporal":[79,125],"provenance":[82,101],"tracking.":[83],"These":[84],"transformations":[85],"are":[86],"specified":[87],"using":[88],"set-theoretic":[89],"definitions":[90],"supported":[92],"by":[93],"four":[94],"theorems":[95],"establishing":[96],"determinism,":[97],"information":[98],"preservation,":[99],"completeness.":[102],"A":[103],"chunk-based":[104],"architecture":[105],"provides":[106],"O(c)":[107],"bounded":[108],"memory.":[109],"Empirical":[110],"evaluation":[111],"UNSW-NB15,":[113],"IoT-23,":[114],"TON_IoT":[116],"demonstrates":[117],"100%":[118],"output":[119],"repeated":[122],"runs,":[123],"robust":[124],"normalisation":[126],"completeness":[127],"over":[128],"formats,":[131],"scalable":[133],"performance":[134],"millions":[136,140],"hundreds":[138],"of":[139,141],"records.":[142]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-12T00:00:00"}