{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,7]],"date-time":"2026-07-07T11:39:06Z","timestamp":1783424346423,"version":"3.54.6"},"reference-count":50,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2024,5,5]],"date-time":"2024-05-05T00:00:00Z","timestamp":1714867200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>In this systematic literature review, we delve into the realm of intention recognition within the context of digital forensics and cybercrime. The rise of cybercrime has become a major concern for individuals, organizations, and governments worldwide. Digital forensics is a field that deals with the investigation and analysis of digital evidence in order to identify, preserve, and analyze information that can be used as evidence in a court of law. Intention recognition is a subfield of artificial intelligence that deals with the identification of agents\u2019 intentions based on their actions and change of states. In the context of cybercrime, intention recognition can be used to identify the intentions of cybercriminals and even to predict their future actions. Employing a PRISMA systematic review approach, we curated research articles from reputable journals and categorized them into three distinct modeling approaches: logic-based, classical machine learning-based, and deep learning-based. Notably, intention recognition has transcended its historical confinement to network security, now addressing critical challenges across various subdomains, including social engineering attacks, artificial intelligence black box vulnerabilities, and physical security. While deep learning emerges as the dominant paradigm, its inherent lack of transparency poses a challenge in the digital forensics landscape. However, it is imperative that models developed for digital forensics possess intrinsic attributes of explainability and logical coherence, thereby fostering judicial confidence, mitigating biases, and upholding accountability for their determinations. To this end, we advocate for hybrid solutions that blend explainability, reasonableness, efficiency, and accuracy. Furthermore, we propose the creation of a taxonomy to precisely define intention recognition, paving the way for future advancements in this pivotal field.<\/jats:p>","DOI":"10.3390\/info15050263","type":"journal-article","created":{"date-parts":[[2024,5,6]],"date-time":"2024-05-06T14:26:11Z","timestamp":1715005571000},"page":"263","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Cybercrime Intention Recognition: A Systematic Literature Review"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-0325-7322","authenticated-orcid":false,"given":"Yidnekachew Worku","family":"Kassa","sequence":"first","affiliation":[{"name":"School of Information Technology and Engineering, Addis Ababa Institute of Technology (AAiT), Addis Ababa University, Addis Ababa P.O. Box 1176, Ethiopia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Joshua Isaac","family":"James","sequence":"additional","affiliation":[{"name":"DFIR Science LLC, Bangkok 10110, Thailand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Elefelious Getachew","family":"Belay","sequence":"additional","affiliation":[{"name":"School of Information Technology and Engineering, Addis Ababa Institute of Technology (AAiT), Addis Ababa University, Addis Ababa P.O. Box 1176, Ethiopia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2024,5,5]]},"reference":[{"key":"ref_1","first-page":"170","article-title":"Cyber Space\u2014Evolution and Growth","volume":"2","author":"Malik","year":"2019","journal-title":"East Afr. Sch. J. Educ. Humanit. Lit."},{"key":"ref_2","first-page":"17","article-title":"The Cyberspace: Redefining A New World","volume":"17","author":"Mbanaso","year":"2015","journal-title":"IOSR J. Comput. Eng."},{"key":"ref_3","unstructured":"Granados Franco, E. (2020). The Global Risks Report, World Economic Forum LLC."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Kent, K., Chevalier, S., Grance, T., and Dang, H. (2006). Guide to Integrating Forensic Techniques into Incident Response.","DOI":"10.6028\/NIST.SP.800-86"},{"key":"ref_5","unstructured":"(2012). Information Technology\u2014Security Techniques\u2014Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence (Standard No. ISO\/IEC 27037:2012)."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"91","DOI":"10.1007\/s40012-012-0008-7","article-title":"Digital forensic research: Current state of the art","volume":"1","author":"Raghavan","year":"2013","journal-title":"CSI Trans. ICT"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"273","DOI":"10.1016\/j.diin.2014.09.002","article-title":"Impacts of increasing volume of digital forensic data: A survey and future research challenges","volume":"11","author":"Quick","year":"2014","journal-title":"Digit. Investig."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Agarwal, S. (2013, January 21\u201323). Data mining: Data mining concepts and techniques. Proceedings of the 2013 International Conference on Machine Intelligence and Research Advancement, Katra, India.","DOI":"10.1109\/ICMIRA.2013.45"},{"key":"ref_9","first-page":"37","article-title":"From data mining to knowledge discovery in databases","volume":"17","author":"Fayyad","year":"1996","journal-title":"AI Mag."},{"key":"ref_10","unstructured":"Heinze, C. (2024, April 01). Modelling Intention Recognition for Intelligent Agent Systems. DSTO Systems Sciences Laboratory. Available online: http:\/\/oai.dtic.mil\/oai\/oai?verb=getRecord&metadataPrefix=html&identifier=ADA430005."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"643010","DOI":"10.3389\/frobt.2021.643010","article-title":"Activity, Plan, and Goal Recognition: A Review","volume":"8","author":"Peer","year":"2021","journal-title":"Front. Robot. AI"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Chen, B., Liu, Y., Li, S., and Gao, X. (2020, January 13). Attack Intent Analysis Method Based on Attack Path Graph. Proceedings of the 2019 9th International Conference on Communication and Network Security, New York, NY, USA. ICCNS\u201919.","DOI":"10.1145\/3371676.3371680"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"467","DOI":"10.1016\/j.jocs.2017.09.007","article-title":"SAIRF: A similarity approach for attack intention recognition using fuzzy min-max neural network","volume":"25","author":"Ahmed","year":"2018","journal-title":"J. Comput. Sci."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Pandey, R., Purohit, H., Stabile, B., and Grant, A. (2018, January 3\u20136). Distributional Semantics Approach to Detect Intent in Twitter Conversations on Sexual Assaults. Proceedings of the 2018 IEEE\/WIC\/ACM International Conference on Web Intelligence (WI), Santiago, Chile.","DOI":"10.1109\/WI.2018.00-80"},{"key":"ref_15","first-page":"151","article-title":"Intrusion intention recognition and response based on weighed plan knowledge graph","volume":"18","author":"Cai","year":"2014","journal-title":"Comput. Model. New Technol."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Dolev, S., Hendler, D., Lodha, S., and Yung, M. (2019). Cyber Security Cryptography and Machine Learning, Proceedings of the Beer-Sheva, Israel, 27\u201328 June 2019, Springer.","DOI":"10.1007\/978-3-030-20951-3"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Cheng, X., Zhang, J., and Chen, B. (2019). Cyber Situation Comprehension for IoT Systems based on APT Alerts and Logs Correlation. Sensors, 19.","DOI":"10.3390\/s19184045"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"184","DOI":"10.1007\/s11036-018-1012-4","article-title":"Attack Detection Application with Attack Tree for Mobile System using Log Analysis","volume":"24","author":"Kim","year":"2019","journal-title":"Mob. Netw. Appl."},{"key":"ref_19","unstructured":"Shinde, A., Doshi, P., and Setayeshfar, O. (2021, January 3\u20137). Cyber Attack Intent Recognition and Active Deception Using Factored Interactive POMDPs. Proceedings of the 20th International Conference on Autonomous Agents and MultiAgent Systems, AAMAS\u201921, Richland, WA, USA."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Zhang, X., Zhang, H., Li, C., Sun, P., Liu, Z., and Wang, J. (2021, January 3\u20134). Network Attack Intention Recognition Based on Signaling Game Model and Netlogo Simulation. Proceedings of the 2021 International Conference on Digital Society and Intelligent Systems (DSInS), Chengdu, China.","DOI":"10.1109\/DSInS54396.2021.9670583"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"de Mendon\u00e7a, R.R., de Brito, D.F., de Franco Rosa, F., dos Reis, J.C., and Bonacin, R. (2020). A framework for detecting intentions of criminal acts in social media: A case study on twitter. Information, 11.","DOI":"10.3390\/info11030154"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"101974","DOI":"10.1016\/j.cose.2020.101974","article-title":"Attack plan recognition using hidden Markov and probabilistic inference","volume":"97","author":"Li","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"105283","DOI":"10.1016\/j.engappai.2022.105283","article-title":"Identification of cyber harassment and intention of target users on social media platforms","volume":"115","author":"Abarna","year":"2022","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Zhao, F., and Miao, D. (2023). International Conference on AI-generated Content, Springer Nature.","DOI":"10.1007\/978-981-99-7587-7"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Navalgund, U.V., and Priyadharshini, K. (2018, January 21\u201322). Crime Intention Detection System Using Deep Learning. Proceedings of the 2018 International Conference on Circuits and Systems in Digital Enterprise Technology (ICCSDET), Kottayam, India.","DOI":"10.1109\/ICCSDET.2018.8821168"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Pang, R., Zhang, X., Ji, S., Luo, X., and Wang, T. (2020, January 6\u201310). AdvMind: Inferring Adversary Intent of Black-Box Attacks. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD\u201920, New York, NY, USA.","DOI":"10.1145\/3394486.3403241"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"102152","DOI":"10.1016\/j.cose.2020.102152","article-title":"Automatically predicting cyber attack preference with attributed heterogeneous attention networks and transductive learning","volume":"102","author":"Zhao","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Mart\u00ednez-Mascorro, G.A., Abreu-Pederzini, J.R., Ortiz-Bayliss, J.C., Garcia-Collantes, A., and Terashima-Mar\u00edn, H. (2021). Criminal Intention Detection at Early Stages of Shoplifting Cases by Using 3D Convolutional Neural Networks. Computation, 9.","DOI":"10.3390\/computation9020024"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"1119","DOI":"10.1007\/s11265-021-01724-5","article-title":"AIGCN: Attack Intention Detection for Power System Using Graph Convolutional Networks","volume":"94","author":"Tang","year":"2022","journal-title":"J. Signal Process. Syst."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Hsu, T., and Tang, C. (2022, January 14\u201316). Detection of Malicious Activities Using Machine Learning in Physical Environments. Proceedings of the 2022 International Conference on Computational Science and Computational Intelligence (CSCI), Los Alamitos, CA, USA.","DOI":"10.1109\/CSCI58124.2022.00185"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Kang, J., Yang, H., Zhang, Y., Dai, Y., Zhan, M., and Wang, W. (July, January 30). ActDetector: A Sequence-based Framework for Network Attack Activity Detection. Proceedings of the 2022 IEEE Symposium on Computers and Communications (ISCC), Rhodes, Greece.","DOI":"10.1109\/ISCC55528.2022.9912824"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Tsinganos, N., Fouliras, P., and Mavridis, I. (2022). Applying BERT for Early-Stage Recognition of Persistence in Chat-Based Social Engineering Attacks. Appl. Sci., 12.","DOI":"10.3390\/app122312353"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Bhugul, A.M., and Gulhane, V.S. (2023, January 18\u201319). Novel Deep Neural Network for Suspicious Activity Detection and Classification. Proceedings of the 2023 IEEE International Students\u2019 Conference on Electrical, Electronics and Computer Science (SCEECS), Bhopal, India.","DOI":"10.1109\/SCEECS57921.2023.10063130"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Tsinganos, N., and Fouliras, P. (2023). Leveraging Dialogue State Tracking for Zero-Shot Chat-Based Social Engineering Attack Recognition. Appl. Sci., 13.","DOI":"10.3390\/app13085110"},{"key":"ref_35","first-page":"244","article-title":"Attack Intention Recognition: A Review","volume":"19","author":"Ahmed","year":"2017","journal-title":"Int. J. Netw. Secur."},{"key":"ref_36","unstructured":"Jesson, J., Matheson, L., and Lacey, F.M. (2011). Doing Your Literature Review: Traditional and Systematic Techniques, SAGE Publications Ltd."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Okoli, C., and Schabram, K. (2010). A guide to conducting a systematic literature review of information systems research. Sprouts Work. Pap. Inf. Syst., 10.","DOI":"10.2139\/ssrn.1954824"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"103","DOI":"10.3316\/QRJ0702103","article-title":"Conducting research literature reviews: From the internet to paper","volume":"7","author":"Caulley","year":"2007","journal-title":"Qual. Res. J."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"n71","DOI":"10.1136\/bmj.n71","article-title":"The PRISMA 2020 statement: An updated guideline for reporting systematic reviews","volume":"372","author":"Page","year":"2021","journal-title":"BMJ"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"152476","DOI":"10.1109\/ACCESS.2021.3124262","article-title":"Digital Forensics Subdomains: The State of the Art and Future Directions","volume":"9","author":"Ikuesan","year":"2021","journal-title":"IEEE Access"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"126","DOI":"10.1016\/j.diin.2019.02.001","article-title":"Evidence collection and forensics on social networks: Research challenges and directions","volume":"28","author":"Arshad","year":"2019","journal-title":"Digit. Investig."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Calegari, R., Ciatto, G., Denti, E., and Omicini, A. (2020). Logic-based technologies for intelligent systems: State of the art and perspectives. Information, 11.","DOI":"10.3390\/info11030167"},{"key":"ref_43","unstructured":"Kraft, D., and Moloney, C. (2016). Introduction to Artificial Intelligence, Springer International Publishing AG."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1007\/978-3-031-31414-8_2","article-title":"Logic-Based Explainability in Machine Learning","volume":"Volume 13759","year":"2023","journal-title":"Reasoning Web. Causality, Explanations and Declarative Knowledge"},{"key":"ref_45","unstructured":"Geib, C.W., and Goldman, R.P. (2001, January 12\u201314). Plan recognition in intrusion detection systems. Proceedings of the DARPA Information Survivability Conference and Exposition II. DISCEX\u201901, Anaheim, CA, USA."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Dodge, J., Liao, Q.V., Zhang, Y., Bellamy, R.K.E., and Dugan, C. (2019, January 17\u201320). Explaining models: An empirical study of how explanations impact fairness judgment. Proceedings of the 24th International Conference on Intelligent User Interfaces, IUI\u201919, New York, NY, USA.","DOI":"10.1145\/3301275.3302310"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Tang, J., Kan, M.Y., Zhao, D., Li, S., and Zan, H. (2019). Natural Language Processing and Chinese Computing: Proceedings of the 8th CCF International Conference, NLPCC 2019, Dunhuang, China, 9\u201314 October 2019, Springer.","DOI":"10.1007\/978-3-030-32233-5"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Maratsi, M.I., Popov, O., Alexopoulos, C., and Charalabidis, Y. (2022, January 4\u20137). Ethical and Legal Aspects of Digital Forensics Algorithms: The Case of Digital Evidence Acquisition. Proceedings of the 15th International Conference on Theory and Practice of Electronic Governance, ICEGOV\u201922, New York, NY, USA.","DOI":"10.1145\/3560107.3560114"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"19","DOI":"10.20517\/jsss.2023.41","article-title":"Bias and fairness in software and automation tools in digital forensics","volume":"5","author":"Jinad","year":"2024","journal-title":"J. Surveill. Secur. Saf."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"3333","DOI":"10.1007\/s11948-020-00276-4","article-title":"Towards Transparency by Design for Artificial Intelligence","volume":"26","author":"Felzmann","year":"2020","journal-title":"Sci. Eng. Ethics"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/15\/5\/263\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T14:39:58Z","timestamp":1760107198000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/15\/5\/263"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,5,5]]},"references-count":50,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2024,5]]}},"alternative-id":["info15050263"],"URL":"https:\/\/doi.org\/10.3390\/info15050263","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,5,5]]}}}