{"id":"https://openalex.org/W7166732163","doi":"https://doi.org/10.48550/arxiv.2606.28812","title":"Extending Detection Engineering to Digital Forensics: The Velociraptor Unified Detection-Forensics Methodology","display_name":"Extending Detection Engineering to Digital Forensics: The Velociraptor Unified Detection-Forensics Methodology","publication_year":2026,"publication_date":"2026-06-27","ids":{"openalex":"https://openalex.org/W7166732163","doi":"https://doi.org/10.48550/arxiv.2606.28812"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.28812","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28812","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.28812","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139660986","display_name":"Aghni Anugrah Raesa","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raesa, Aghni Anugrah","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018405344","display_name":"A Rajan Nambiar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nambiar, Adithyan Shaji","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139701213","display_name":"Veda Dawoonauth","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dawoonauth, Veda","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139674545","display_name":"Aditya Kumar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kumar, Aditya","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139711841","display_name":"Mike Cohen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cohen, Mike","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139659019","display_name":"Priyanka Singh","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Singh, Priyanka","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.97079998254776,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.97079998254776,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13192","display_name":"Forensic Fingerprint Detection Methods","score":0.0044999998062849045,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10751","display_name":"Forensic and Genetic Research","score":0.004100000020116568,"subfield":{"id":"https://openalex.org/subfields/1311","display_name":"Genetics"},"field":{"id":"https://openalex.org/fields/13","display_name":"Biochemistry, Genetics and Molecular Biology"},"domain":{"id":"https://openalex.org/domains/1","display_name":"Life Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/triage","display_name":"Triage","score":0.8302000164985657},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.6159999966621399},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.6136000156402588},{"id":"https://openalex.org/keywords/clearance","display_name":"Clearance","score":0.6060000061988831},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.5705000162124634},{"id":"https://openalex.org/keywords/point","display_name":"Point (geometry)","score":0.4821999967098236},{"id":"https://openalex.org/keywords/volume","display_name":"Volume (thermodynamics)","score":0.3095000088214874}],"concepts":[{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.8302000164985657},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.680400013923645},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.6159999966621399},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.6136000156402588},{"id":"https://openalex.org/C138944611","wikidata":"https://www.wikidata.org/wiki/Q1163287","display_name":"Clearance","level":2,"score":0.6060000061988831},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.5705000162124634},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.4821999967098236},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4489000141620636},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.35690000653266907},{"id":"https://openalex.org/C20556612","wikidata":"https://www.wikidata.org/wiki/Q4469374","display_name":"Volume (thermodynamics)","level":2,"score":0.3095000088214874},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.301800012588501},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.27399998903274536},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.27230000495910645},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2671000063419342},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.26350000500679016},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.28812","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28812","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.28812","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.28812","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.545555055141449,"display_name":"Partnerships for the goals","id":"https://metadata.un.org/sdg/17"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Detection":[0],"engineering":[1],"and":[2,19,59,70,79,94,113,152,160],"digital":[3],"forensics":[4],"have":[5],"evolved":[6],"in":[7,11],"parallel":[8],"rather":[9],"than":[10],"partnership,":[12],"leaving":[13],"a":[14,25,49,83,139,153],"gap":[15],"between":[16],"real-time":[17],"alerting":[18],"forensic":[20,107],"analysis.":[21,166],"This":[22],"paper":[23],"develops":[24],"unified":[26],"detection-forensics":[27],"methodology":[28,51],"using":[29,86],"Velociraptor,":[30],"where":[31],"detection":[32,72],"logic":[33],"directly":[34],"initiates":[35],"targeted":[36],"evidence":[37,54,115],"acquisition":[38],"at":[39],"the":[40,137],"point":[41],"of":[42],"detection.":[43],"The":[44],"contribution":[45],"is":[46],"threefold:":[47],"(1)":[48],"four-stage":[50],"(baseline":[52],"establishment,":[53],"correlation,":[55],"attack":[56],"chain":[57],"analysis,":[58],"scenario":[60],"labelling":[61],"with":[62],"confidence)":[63],"that":[64,96,102,116],"converts":[65],"artefact":[66,118,165],"knowledge":[67],"into":[68],"reusable":[69],"testable":[71],"rules":[73],"suitable":[74],"for":[75,142],"both":[76,158],"post-incident":[77],"triage":[78,108,143,159],"live":[80],"monitoring;":[81],"(2)":[82],"practical":[84],"demonstration,":[85],"three":[87],"Velociraptor":[88],"BaseVQL":[89],"log":[90],"sources":[91],"(/forensics/windows/prefetch,":[92],"/forensics/windows/usn,":[93],"/windows/wmi)":[95],"practitioners":[97],"can":[98],"deploy":[99],"today,":[100],"showing":[101],"artefact-based":[103],"detections":[104],"enable":[105],"scalable":[106],"without":[109],"full":[110],"disk":[111],"acquisition;":[112],"(3)":[114],"periodic":[117,164],"analysis":[119],"offers":[120],"continuous":[121,161],"monitoring":[122,162],"while":[123],"substantially":[124],"reducing":[125],"data":[126],"volume":[127],"compared":[128],"to":[129],"conventional":[130],"endpoint":[131],"logging.":[132],"Two":[133],"case":[134],"studies":[135],"illustrate":[136],"approach:":[138],"Prefetch/USN":[140],"baseline":[141],"when":[144],"Windows":[145],"Event":[146],"Logs":[147],"are":[148],"cleared":[149],"or":[150],"unavailable,":[151],"WMI":[154],"persistence":[155],"correlation":[156],"supporting":[157],"through":[163]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-01T00:00:00"}