## 4 The Impact of MLF on the DFI Process  
As can be seen in Section 3, a review of research papers examines the contributions of ML techniques to DF in smart environments. It also identifies digital forensic issues that each of the reviewed papers addresses and proposes solutions that are based on machine learning to improve the DFI process. Table 1 summarises the role of ML techniques in the DFI process. The column headers present the paper reference number, the ML techniques used, and the main ISO/IEC 27043:2015 process class headings. Table 1 presents the role of ML techniques in ISO/IEC 27043:2015 DFI processes and highlights gaps where ML techniques may be used to improve the processes. An \"X\" in a particular cell indicates that the specific ML technique was applied in the processes indicated. These techniques contributed mainly to the initialisation and investigative processes of the ISO/IEC 27043:2015 set of standards, and there was a lack of application of ML techniques to the other process areas of this standard. Applying ML and AI techniques in the areas of ISO/IEC 27043:2015 can automate and improve the DFI process, since the uncovered areas are currently mostly processed manually. For example, the Markov chain model (see Table 1[5]) already automates the analysis process through two main components, referred to as the'modifier' and 'analyser' components. The'modifier' component examines smart applications in search \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Reference No.** & **Used ML Technique** & \begin{tabular}{c} **Readiness** \\ **Processes** \\ \end{tabular} & \begin{tabular}{c} **Initialisation** \\ **Processes** \\ \end{tabular} & \begin{tabular}{c} **Acquisitive** \\ **Processes** \\ \end{tabular} & \
\begin{tabular}{c} **Investigative** \\ **Processes** \\ \end{tabular} &
\begin{tabular}{c} **Concurrent** \\ **Processes** \\ \end{tabular} \\ \hline
[5] & Markov chain model & & & & X & \\ \hline
[6] & Supervised machine learning & X & & X & \\ \hline
[16] & Supervised machine learning & & & X & \\ \hline
[17] & Unsupervised identification & X & & X & \\ \hline
[18] & Markov chain model & & & X & \\ \hline
[19] & Logical regression & X & X & \\ \hline
[21] & Logistic regression & & & X & \\ \hline
[22] & Markov chain model & X & & & \\ \hline
[23] & Decision-tree algorithm & & & X \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The role of ML techniques in the DFI process ISO/IEC 27043:2015.  
of forensically significant information then modifies the smart application by introducing specialised logs and sending them to a specialised logs database. The 'analyser' component uses data processing and Markov chain models on the logs database to learn the status of the smart environment and the users' activity during the time of the forensic analysis so as to identify possible security violations from people, devices, or smart apps. However, the technique presented in [5] does not focus on the automation of any of the other ISO/IEC 27043:2015 processes. The remainder of Table 1 can be interpreted in a similar fashion. The authors furthermore propose the integration of ML techniques into ISO/IEC 27043:2015 processes that are not currently covered by ML techniques. While there currently exist several digital forensic process models, Table 1 explores the integration of ML techniques into the ISO/IEC 27043:2015 set of standards, since this standard represents the de facto DFI process owing to its widespread acceptance and ability to integrate new digital forensic methods into its existing processes. Such integration can improve efficiency and reduce time and human effort by automating the manual tasks of the DFI process. For example, it was proposed by [17] that intelligent methods for intrusion detection and real-time intrusion prevention be used with two main techniques--rule-based and anomaly-based--to support DFI. Rule-based techniques mostly utilise databases that include predefined rules to detect known intrusions.