An Intelligent Behavioral Anomaly Detection Framework for Next-Generation Digital Forensics Using Hybrid Deep Learning and Context-Aware Feature Fusion

Digital forensics has become increasingly critical in detecting and investigating complex cyber incidents involving insider threats, advanced persistent attacks, and multi-stage intrusions. This study proposes an Intelligent Behavioral Anomaly Detection Framework that integrates Hybrid Deep Learning with Context-Aware Feature Fusion to enhance the detection and analysis of anomalous activities in diverse computing environments. The framework collects multi-source digital evidence, including system logs, network flows, process traces, and user interaction histories, ensuring forensic integrity through SHA-256 hashing. Preprocessing involves noise removal, imputation, and Min-Max normalization, followed by advanced behavioral feature engineering that captures temporal, contextual, and relational attributes. Multi-head attention and cross-modal fusion mechanisms integrate heterogeneous features into a unified representation, which is then processed by a hybrid architecture combining 1D-CNN, Bi-LSTM, and autoencoder modules for supervised and unsupervised anomaly detection. Experimental results on a benchmark forensic dataset demonstrate that the proposed framework achieves 98.1 % accuracy, 97.9 % precision, 98.3 % recall, and an F 1 -score of 98.1 %, outperforming Random Forest, SVM, XGBoost, and standalone deep learning baselines. The system also exhibits strong robustness under noisy and adversarial conditions, maintaining detection accuracy above 97 %. Furthermore, the integration of graph-based forensic correlation enables reconstruction of attack timelines, improving investigative efficiency and legal admissibility of evidence. This work represents a significant advancement in AI-driven digital forensics by combining predictive accuracy, interpretability, and operational resilience, making it suitable for nextgeneration cyber defense environments.