## 3 State-of-the-Art Use of Machine-Learning Techniques in Digital Forensics
The proposed tool allows network traffic features to be computed in real time on any WiFi access point running the OpenWrt firmware, avoiding the time-consuming tasks of dumping network traffic and implementing the procedures needed to analyse the captured traffic. On the other hand, due to the lack of examination and available data, ref. [26] selected a smart fridge as an IoT device to be examined and investigated. The dataset was examined using two ML algorithms, Bayes net and decision stump. Each algorithm represents a distinct idea. A stump tree is a simple version of the decision-tree ML technique. The Bayes net is useful for estimating the likelihood of numerous recognised causes, one of which is the occurrence of an event. The validation results indicate that the Bayes net algorithm is more accurate than the decision stump tree. Research shows that the main issues that face DF investigators in the smart environment are the large volume of data and attack and violation detection. The proposed solutions are summarised in Figures 2 and 3. The authors decided to split the summary into two separate figures, since there were two main themes detected in all existing solutions: the first theme involved MLF solutions for large amounts of data, while the second theme involved MLF solutions for attack and violation detection. Figure 2 summarises the applications of MLF that were reported in research papers from 2018 to 2023 to serve as proposed solutions for dealing with the large amounts of data generated in smart environments. The following list explains the elements of Figure 2 in more detail:  
* The _IoTDots framework_ was proposed as a solution to deal with the large amounts of data collected by IoT devices and sensors. * _Automatic prioritisation of suspicious file artefacts_ was proposed as a solution to deal with the growing volume of data and manual retrieval of suspicious files. * _Intelligent methods to automate problem-solving_ were proposed as a solution to deal with the massive amounts of data that must be analysed for digital evidence. * _Automation using ML techniques for classification and AI techniques for prioritising suspicious devices_ was proposed as a solution to deal with the growing number of cases needing DF competence and the large volumes of data to be processed. * _Automatic text analysis to detect online sexual predatory talks_ was proposed as a solution to deal with the growth of cybercrime targeting minors, the large volume of data, and the DFI process, which is done primarily by hand. Figure 3: MLF solutions for attack and violation detection in smart environments. Figure 2: MLF solutions for large amounts of data in smart environments. * _The \"VERITAS\" mechanism_ to automatically collect and extract forensic evidence from smart environments was proposed as a solution to deal with the large amounts of data that is generated in smart environments. Figure 3 summarises the applications of ML in DF as proposed in research published between 2018 and 2023 for detecting data attacks and violations in smart environments. The following list explains Figure 3 in more detail:  
* _An intelligent intrusion detection system_ to detect regular and malicious attacks on data created in smart environments was proposed as a solution to deal with the simple and complex attacks that face IoT networks in particular. * _A blockchain-assisted shared audit framework_ for identifying data-scavenging attacks in virtualised resources was proposed as a solution to deal with attack and violation detection in smart environments. * _An intelligent forensic analysis mechanism_ was proposed as a solution to deal with the probability of continual attacks on IoT devices and the low processing power and memory of these devices. The following section discusses the impact of ML on the DFI process.