In this systematic literature review, we delve into the realm of intention recognition within the context of digital forensics and cybercrime. The rise of cybercrime has become a major concern for individuals, organizations, and governments worldwide. Digital forensics is a field that deals with the investigation and analysis of digital evidence in order to identify, preserve, and analyze information that can be used as evidence in a court of law. Intention recognition is a subfield of artificial intelligence that deals with the identification of agents’ intentions based on their actions and change of states. In the context of cybercrime, intention recognition can be used to identify the intentions of cybercriminals and even to predict their future actions. Employing a PRISMA systematic review approach, we curated research articles from reputable journals and categorized them into three distinct modeling approaches: logic-based, classical machine learning-based, and deep learning-based. Notably, intention recognition has transcended its historical confinement to network security, now addressing critical challenges across various subdomains, including social engineering attacks, artificial intelligence black box vulnerabilities, and physical security. While deep learning emerges as the dominant paradigm, its inherent lack of transparency poses a challenge in the digital forensics landscape. However, it is imperative that models developed for digital forensics possess intrinsic attributes of explainability and logical coherence, thereby fostering judicial confidence, mitigating biases, and upholding accountability for their determinations. To this end, we advocate for hybrid solutions that blend explainability, reasonableness, efficiency, and accuracy. Furthermore, we propose the creation of a taxonomy to precisely define intention recognition, paving the way for future advancements in this pivotal field.

In this comprehensive review, we delve into the realm of intention recognition within the context of digital forensics and cybercrime. The rise of cybercrime has become a major concern for individuals, organizations, and governments worldwide. Digital forensics is a field that deals with the investigation and analysis of digital evidence in order to identify, preserve, and analyze information that can be used as evidence in a court of law. Whereas, Intention recognition is a subfield of artificial intelligence that deals with the identification of agents’ intentions based on their actions and change of states. In the context of cybercrime, intention recognition can be used to identify the intentions of cybercriminals and even to predict their future actions. Employing a meticulous six-step systematic review approach, we curated research articles from reputable journals and categorized them into three distinct modeling approaches: logic-based, classical machine learning-based, and deep learning-based. Notably, intention recognition has transcended its historical confinement to network security, now addressing critical challenges across various subdomains, including social engineering attacks, AI black box vulnerabilities, and physical security. While deep learning emerges as the dominant paradigm, its inherent lack of transparency poses unique challenges in the digital forensics landscape. We advocate for hybrid solutions that blend deep learning’s power with interpretability. Furthermore, we propose the creation of a comprehensive taxonomy to precisely define intention recognition, paving the way for future advancements in this pivotal field.

The rapid advancement of technology has been matched by a significant rise in cybercrime, posing substantial challenges for digital forensics investigators who must handle increasingly complex cases and navigate vast volumes of evidence. While current research on intent recognition has largely focused on cybersecurity measures for preventing attacks, there has been a noticeable gap in the integration of legal intent analysis with technical digital forensics. This paper addresses this gap by presenting an innovative model that combines legal and technical perspectives through a formal model. The model consists of three core components—Evidence Analysis, Intent Recognition, and a Criminal Repository—that systematically process digital evidence, reconstruct crime scenes, identify criminal intent, and offer recommendations for the conviction process. Using formal methods, the model rigorously defines key concepts such as crime, intent, and intent types, ensuring its robustness and reliability. By stimulating the model using phishing attack scenarios, we validate the model’s capability, demonstrating its ability to identify various types of intent and manage complex cases. Looking forward, we suggest implementing the model by incorporating advanced AI approaches, particularly Agentic AI, or combining logic-based methods with explainable AI. This advancement would help address huge volume-related challenges of digital forensics and provide a powerful tool for modern investigative practices.