{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T04:09:45Z","timestamp":1773720585101,"version":"3.50.1"},"reference-count":30,"publisher":"MDPI AG","issue":"6","license":[{"start":{"date-parts":[[2025,5,23]],"date-time":"2025-05-23T00:00:00Z","timestamp":1747958400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Systems"],"abstract":"<jats:p>In digital forensics, especially Windows forensics, identifying anomalous file paths is crucial when dealing with large-scale data. Traditional static embedding methods, which aggregate token-level representations, discard hierarchical and sequential relationships in file paths, leading to misclassification of anomalies. This study introduces a Transformer-based sequence modeling approach to classify anomalous file paths, addressing these limitations by preserving positional and contextual relationships. File paths from the NTFS Master File Table (MFT) were embedded using FastText to capture structural and contextual dependencies. Unlike static embeddings, the proposed method processes file paths as structured sequences to enhance anomaly detection accuracy. Extensive experiments showed that Transformer models generally outperformed traditional methods in detecting structured anomalies. The Transformer model with FastText embeddings (32 dimensions) achieved an accuracy of 0.9781 and an F1-score of 0.9782, while Random Forest with FastText embeddings (64 dimensions) achieved an accuracy of 0.9729 and an F1-score of 0.9729. These findings suggest that a hybrid anomaly detection framework combining Transformer-based models with traditional techniques could enhance robustness in forensic investigations. Future research should explore combining both methods to improve adaptability across diverse forensic scenarios.<\/jats:p>","DOI":"10.3390\/systems13060403","type":"journal-article","created":{"date-parts":[[2025,5,23]],"date-time":"2025-05-23T06:16:03Z","timestamp":1747980963000},"page":"403","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Effective Context-Aware File Path Embeddings for Anomaly Detection"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-7595-7139","authenticated-orcid":false,"given":"Ra-Kyung","family":"Lee","sequence":"first","affiliation":[{"name":"Department of Cyber Security, Dankook University, Jukjeon-ro 152, Yongin-si 16890, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0048-4231","authenticated-orcid":false,"given":"Hyun-Min","family":"Song","sequence":"additional","affiliation":[{"name":"Department of Cyber Security, Dankook University, Jukjeon-ro 152, Yongin-si 16890, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3840-2254","authenticated-orcid":false,"given":"Taek-Young","family":"Youn","sequence":"additional","affiliation":[{"name":"Department of Cyber Security, Dankook University, Jukjeon-ro 152, Yongin-si 16890, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,5,23]]},"reference":[{"key":"ref_1","unstructured":"Carrier, B. (2005). File System Forensic Analysis, Addison-Wesley Professional."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"298","DOI":"10.1016\/j.diin.2004.10.002","article-title":"On the role of file system metadata in digital forensics","volume":"1","author":"Buchholz","year":"2004","journal-title":"Digit. Investig."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3505244","article-title":"Transformers in vision: A survey","volume":"54","author":"Khan","year":"2022","journal-title":"ACM Comput. Surv. CSUR"},{"key":"ref_4","first-page":"53","article-title":"A comparison of machine learning techniques for file system forensics analysis","volume":"46","author":"Mohammad","year":"2019","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Du, X., Le, Q., and Scanlon, M. (2020, January 15\u201319). Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events. Proceedings of the 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), Dublin, Ireland.","DOI":"10.1109\/CyberSecurity49315.2020.9138874"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"4119","DOI":"10.1109\/TNSM.2021.3125967","article-title":"Log Sequence Anomaly Detection Based on Local Information Extraction and Globally Sparse Transformer Model","volume":"18","author":"Zhang","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"3479","DOI":"10.1109\/TSC.2023.3280575","article-title":"Loader: A Log Anomaly Detector Based on Transformer","volume":"16","author":"Xiao","year":"2023","journal-title":"IEEE Trans. Serv. Comput."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Stein, K., Mahyari, A., Francia, G., and El-Sheikh, E. (2024, January 29\u201331). A Transformer-Based Framework for Payload Malware Detection and Classification. Proceedings of the 2024 IEEE World AI IoT Congress (AIIoT), Seattle, WA, USA.","DOI":"10.1109\/AIIoT61789.2024.10579000"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"4015","DOI":"10.1109\/ACCESS.2021.3139835","article-title":"Intrusion Detection Using Payload Embeddings","volume":"10","author":"Hassan","year":"2022","journal-title":"IEEE Access"},{"key":"ref_10","first-page":"1","article-title":"Lightweight IDS Framework Using Word Embeddings for In-Vehicle Network Security","volume":"15","author":"Kim","year":"2024","journal-title":"J. Wirel. Mob. Netw. Ubiquitous Comput. Dependable Appl."},{"key":"ref_11","first-page":"100786","article-title":"Fast and Efficient Context-Aware Embedding Generation Using Fuzzy Hashing for In-Vehicle Network Intrusion Detection","volume":"47","author":"Choi","year":"2024","journal-title":"Veh. Commun."},{"key":"ref_12","first-page":"100471","article-title":"A hybrid deep learning based intrusion detection system using spatial-temporal representation of in-vehicle network traffic","volume":"35","author":"Lo","year":"2022","journal-title":"Veh. Commun."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"16006","DOI":"10.1109\/TITS.2023.3286611","article-title":"Deep Learning-Based Anomaly Detection for Connected Autonomous Vehicles Using Spatiotemporal Information","volume":"24","author":"Mansourian","year":"2023","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"101063","DOI":"10.1016\/j.iot.2024.101063","article-title":"Anomaly detection based on Artificial Intelligence of Things: A Systematic Literature Mapping","volume":"25","author":"Trilles","year":"2024","journal-title":"Internet Things"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Deng, A., and Hooi, B. (2021, January 2\u20139). Graph neural network-based anomaly detection in multivariate time series. Proceedings of the AAAI Conference on Artificial Intelligence, Virtually.","DOI":"10.1609\/aaai.v35i5.16523"},{"key":"ref_16","unstructured":"Pang, G., Ding, C., Shen, C., and Hengel, A.v.d. (2021). Explainable deep few-shot anomaly detection with deviation networks. arXiv."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Ji, I.H., Lee, J.H., Kang, M.J., Park, W.J., Jeon, S.H., and Seo, J.T. (2024). Artificial intelligence-based anomaly detection technology over encrypted traffic: A systematic literature review. Sensors, 24.","DOI":"10.3390\/s24030898"},{"key":"ref_18","unstructured":"Huang, H., Wang, P., Pei, J., Wang, J., Alexanian, S., and Niyato, D. (2025). Deep Learning Advancements in Anomaly Detection: A Comprehensive Survey. arXiv."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Pang, G., Shen, C., Jin, H., and van den Hengel, A. (2023, January 6\u201310). Deep weakly-supervised anomaly detection. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Long Beach, CA, USA.","DOI":"10.1145\/3580305.3599302"},{"key":"ref_20","unstructured":"Exterro (2024, April 21). FTK Imager. Available online: https:\/\/www.exterro.com\/digital-forensics-software\/ftk-imager."},{"key":"ref_21","unstructured":"rowingdude (2024, May 01). analyzeMFT. Available online: https:\/\/github.com\/rowingdude\/analyzeMFT."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1162\/tacl_a_00051","article-title":"Enriching word vectors with subword information","volume":"5","author":"Bojanowski","year":"2017","journal-title":"Trans. Assoc. Comput. Linguist."},{"key":"ref_23","unstructured":"Facebook (2024, October 05). fastText. Available online: https:\/\/github.com\/facebookresearch\/fastText."},{"key":"ref_24","unstructured":"Burges, C., Bottou, L., Welling, M., Ghahramani, Z., and Weinberger, K. (2013, January 5\u20138). Distributed Representations of Words and Phrases and their Compositionality. Proceedings of the Advances in Neural Information Processing Systems, Lake Tahoe, NV, USA."},{"key":"ref_25","first-page":"15908","article-title":"Transformer in Transformer","volume":"Volume 34","author":"Ranzato","year":"2021","journal-title":"Proceedings of the Advances in Neural Information Processing Systems"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1109\/TPAMI.2022.3152247","article-title":"A Survey on Vision Transformer","volume":"45","author":"Han","year":"2023","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Suthaharan, S. (2016). Support vector machine. Machine Learning Models and Algorithms for Big Data Classification: Thinking with Examples for Effective Learning, Springer.","DOI":"10.1007\/978-1-4899-7641-3"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1023\/A:1010933404324","article-title":"Random forests","volume":"45","author":"Breiman","year":"2001","journal-title":"Mach. Learn."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Gurney, K. (2018). An Introduction to Neural Networks, CRC Press.","DOI":"10.1201\/9781315273570"},{"key":"ref_30","unstructured":"Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., and Garnett, R. (2017, January 4\u20139). LightGBM: A Highly Efficient Gradient Boosting Decision Tree. Proceedings of the Advances in Neural Information Processing Systems, Long Beach, CA, USA."}],"container-title":["Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2079-8954\/13\/6\/403\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T17:38:55Z","timestamp":1760031535000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2079-8954\/13\/6\/403"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,23]]},"references-count":30,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2025,6]]}},"alternative-id":["systems13060403"],"URL":"https:\/\/doi.org\/10.3390\/systems13060403","relation":{},"ISSN":["2079-8954"],"issn-type":[{"value":"2079-8954","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,5,23]]}}}