{'fraction_non_alphanumeric': 0.02637135751489841, 'fraction_numerical': 0.009478672985781991, 'mean_word_length': 5.333432392273402, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Toward Multimodal Interaction in Scalable Visual Digital Evidence Visualization Using Computer Vision Techniques and ISS

Visualization requirements in Forensic Lucid have to do with different levels of case knowledge abstraction, representation, aggregation, as well as the operational aspects as the final long-term goal of this proposal. It encompasses anything from the finer detailed representation of hierarchical contexts to Forensic Lucid programs, to the documented evidence and its management, its linkage to programs, to evaluation, and to the management of GIPSY software networks. This includes an ability to arbitrarily switch between those views combined with usable multimodal interaction. The purpose is to determine how the findings can be applied to Forensic Lucid and investigation case management. It is also natural to want a convenient and usable evidence visualization, its semantic linkage and the reasoning machinery for it. Thus, we propose a scalable management, visualization, and evaluation of digital evidence using the modified interactive 3D documentary system - Illimitable Space System - (ISS) to represent, semantically link, and provide a usable interface to digital investigators that is navigable via different multimodal interaction techniques using Computer Vision techniques including gestures, as well as eye-gaze and audio.


Introduction
We propose a scalable management, visualization, and evaluation of digital evidence using the modified interactive 3D documentary component of the Illimitable Space System (ISS) to represent, semantically link, and provide a usable interface to digital investigators.
The cyberforensic analysis is one phase of the cybercrime investigation where the investigators strive to produce credible inferences based on evidential information. The source of this information is usually the phases that precede the analysis such as evidence acquisition and encoding. Also, this information can come from an esoteric set of resources that involves computers but is not limited to that seem fit as an evidence by the investigators [1,9].
Lucid programs are data-flow programs that can be visually composed and illustrated as data-flow graphs as well. Forensic Lucid is one such Lucid dialect that enables investigators to specify and reason about cyberforensic cases. It represents the context of the evaluation of the evidences' by encoding them along with witness stories, evidential statements and modeling the crime scene to cross-validate claims against the model and perform event reconstruction, potentially within large swaths of digital evidence [1,9].
In 2004, Gladyshev [10] introduced the first formal approach to cybercrime investigation. Their approach uses Finite State Automata to describe the digital system as a Finite State Machine for event reconstruction. However, it has an associated learning curve and quite complex for investigators without a formal background in computer science. Forensic Lucid is designed to explicitly address these drawbacks and aims to be usable, expressive, sound and complete.
One of the many goals of Forensic Lucid is usability via scalable visualization of enormous data under investigation. Recently, there have been significant improvements in the domain of modern 2D and 3D virtual reality environments, which can be easily navigated via a variety of different multimodal interaction techniques. Forensic Lucid aims to up the ante by providing such usability improvements by leveraging modern multimodal techniques in virtual and augmented reality space for the investigators instead of writing a Forensic Lucid program to navigate seamlessly. A combination of gestures, audio commands, eye gaze and hardware controllers are potential candidates to provide navigational and interaction abilities to the investigators. It will enable us to extend the Lucid DFG programming onto Forensic Lucid case modeling and specification [1,9].
The purpose here is to determine the applicability of these findings to Forensic Lucid and investigation case management. It is also natural to want a convenient and usable evidence visualization, their semantic linkage and the appropriate hardware for the same. The visualization requirements in the context of Forensic Lucid revolve around the different levels of the case knowledge abstraction, its representation, aggregation, and the operational aspects as the final long-term goal of this proposal. It encompasses everything from the finer detailed representation of hierarchical contexts to Forensic Lucid programs, to the documented evidence and its management. It also includes its linkage to programs, to evaluation and to the management of GIPSY software-defined networks along with an ability to arbitrarily switch between those views combined with usable multimodal interaction [1,9].

Related Work
In the context of data-flow programming languages, there are quite a few research works and proposals that revolve around graph-based visualizations. The work of Faustini proved in particular a visualization of any Indexical Lucid program as a DFG [11].
In 1995, Jagannathan defined one of the first graph-based visualizations proposals for Lucid programs. He defined different graphic intensional and extensional models for GLU programming [12]. Further, in 1999 Paquet's doctoral work with multidimensional intensional programs extended on it, followed by the visual parallel programming idea of Stankovic, Orgun, et al. [13] [14].
In 2004, Ding provided practical implementation of Paquet's foundational work within GIPSY in the form of 2D DFGs [13,15] [15]. Ding provided an automatic bidirectional translation of the intensional programs between their textual and graphical representations by employing lefty's GUI (Graphviz's) and dot's languages [9,16,17].
Mokhov proposed an idea of one such "3D editor" within RIPE [18] to visualize, control communication patterns and load balancing in GIPSY. The editor's idea is to render graphs in a 3D space to allow its users to redistribute demands visually in case of imbalance of workload among the workers. It can be thought of as a virtual 3D remote control accompanied by a miniature expert system which can trigger the planning, caching and load balancing algorithms to learn and perform efficiently every time a related GIPSY application is run.
These works defined key concepts that are consistent with GIPSY [9] visual mechanisms especially, the General Manager Tier (GMT) [24]. Rabah provided the initial configuration management and PoC visualization for GIPSY nodes and tiers via the above mentioned GMT [25].
In 2012, Tao et al . proposed another interesting work of relevance on the visual representa-tion of event sequences, reasoning, and visualization of EHR data [26]. Wang et al . put forward a temporal search algorithm for event visualization of personal history [27]. Monroe et al . noted the challenges of specifying intervals and absences in temporal queries and approach those with the use of a graphical language [28]. This could be of particular use for no-observations [1] in Forensic Lucid case. A recent novel HCI concept of documentary knowledge visual representation and gesture-and speech-based interaction in the Illimitable Space System (ISS) was put forward by Song [29] in 2012. A multimodal case management interaction system was proposed for the German police called Vispol Tangible Interface: An Interactive Scenario Visualization 1 . Building upon the above-mentioned works, we propose to illustrate nested evidence, crime scene and the reconstructed event flow after revaluation in the form of a 2D or 3D DFG. The direct impact is to aid the forensic investigators by providing a scalable visualization, management of evidence modeling, encoding by Forensic Lucid [1,[30][31][32] and subsequently its evaluation by GIPSY [9].

Conceptual Visualization Design
Deriving from the related research work in context to visualization of Lucid programs, a conceptual example of a 2D DFG that corresponds to a simple Lucid program produced by Paquet [13]. Presently, the rendering of the same is by Ding in 2004 [15] within the GIPSY environment [9].
In Figure 2, page 4 is the conceptual model of hierarchical nesting of the evidential observation sequences os, their individual observations o (consisting of the properties being observed (P, min, max, w, t), details of which are discussed in the referenced related works and in [1,Chapter 7]). These 2D conceptual visualizations are proposed to be renderable at least in 2D or in 3D via an interactive interface to allow modeling complex crime scenes and multidimensional evidence on demand. The end result is envisioned to look like either expanding or "cutting out" nodes or complex-type results as exemplified in Figure 1

Multimodal Visual Encoding of Forensic Lucid-based Evidence
Data visualization, not only in the context of cybercrime investigation with Forensic Lucid, but in almost every other domain as well provides numerous advantages in terms of deducing inferences, spotting anomalies and recognizing patterns. However, specifically in case of Forensic Lucid and investigating cybercrimes, it provides additional usability [33] enhancements to aid investigators to illustrate and define semantic links among the related evidence. Furthermore, the need to visualize forensic cases, digital evidence, and related specification components revolve around providing usability enhancements to aid the investigators. Additionally, putting the program (specification) in 3 dimensions, especially in the modern and affordable augmented and virtual reality spaces (AR/VR) will help in structuring the program along with the case well arranged in a virtual environment with the digital evidence enclosed within 3D spheres. Moreover, navigable in depth to whatever levels of detail possibly via one of the multimodal interactions, although in the given example via clicking, issuing voice commands, gazing, or gesturing [9]. In case of event reconstruction, in particular, the illustrations and comprehension of operational semantics and demand-driven models are much better along keeping in mind their depth and complexity. Ding's work provides navigational capabilities from a graph to subsequent subgraphs via extending complex nodes to their definitions as in whenever (wvr) or advances upon (upon), their reverse operators, forensic operators, and others [9] found in [1, Chapter 7].

Augmented System Requirements
In order to realize the envisage of DFG visualization of Forensic Lucid programs and their evaluation by GIPSY some immediate considerations are discussed below [9]: • Hierarchical evidential statements with deeply nested contexts should be visualized [9].
• Intentional-imperative hybrid nodes need to be placed in DFGs combining fragments of Lucid and Java programs [9]. Previous research works by GIPSY R&D did not address the aspects to augment the DFGAnalyzer and DFGGenerator from Ding's work in some fashion to provide support for hybrid GIPSY programs. However, to address this one can think to add an "unexpandable" imperative DFG node to the graph, but depth-wise it won't be just enough to click their way through. Thus, considering possibilities to make it usable hence expandable recent enhancements in Graphviz and GIPSY can be leveraged to generate Forensic Lucid code from the DFG and vice versa [9].
• Rabah's work on visualizing load balancing and communication control patterns for tasks in Euclidean space may as well be leveraged via the GGMT [25].
• The ability to switch among views such as DFG, evidence, and control, etc., is required as well.
• In flat-screen, touch-screen, augmented reality or projected environments, 3D DFG interactions are to support click and touch or voice-based call-outs as well as gestures to link or assemble some of the evidence [4].
• In the virtual reality environment VR controllers and gaze-controlled interactions are essential in addition to the voice and gesture recognition support [34].

Survey of the Visualization Languages and Tools
This work focuses on one of the goals of this research, which is to find the optimal technique with its formal specifications along with being feasible to implement using currently available HCI technologies and a usable one [9].

Graphviz
Ding's [15] basic bidirectional translation between GIPL and DFG within GIPSY is already a part of the project and exists for GIPL and Indexical Lucid, the two Lucid dialect antecedents. Moreover, Graphviz modern version now supports integration with Eclipse [35], thus GIPSY's IDE-RIPE (Run-time Interactive Programming Environment)-can be an Eclipsebased plug-in as well [9].

PureData
The PureData [36] language by Puckette along with its commercial divisions namely (Jitter/-Max/MSP [37]) apply a DFG-lie programming by graphically placing inlets and outlets of any data type connected in the form of so-called "patches". These inlets may have external implementations and sub-graphs in procedural languages. Originally, Puckett's work used signal processing to process electronic music and videos in order to produce interactive artistic and performative processes and was extended beyond that domain. The notion of external plug-ins in PureData allows deep visualization of media in OpenGL which in turn enhances the overall aspect of the process. PureData does draw influence from Lucid as a data flow language as well [9].

BPEL
OpenESB IDE provides visual design capabilities to visually illustrate or create a BPEL (Business Process Execution Language) process along with composite applications in the context of Service Oriented Architectures and Web Services. [38][39][40]. These BPEL specifications are translatable to an executable web service composition code in Java language. Not only it provides capabilities in terms of designing flows between structures, parallel, asynchronous, sequential processes and fault realization, but more importantly, BPEL notations have a backing formalism modeled upon based on Petri nets. BPEL specifications' composite applications actually translate to executable Java web services composition code [9].

Illimitable Space System (ISS)
Original ISS's research-creation practices focused primarily on interactive multimodal installations and productions with the collaboration of local artistic troupes. It helped mobilizing traditional artists and makes them aware of the new technology in order to express themselves in the new form of artistic approach. It started off as a new HCI in the theatre concept and interactive documentaries and moved to performing arts and alternate realities. Various versions of Illimitable Space System exist for motion capture, signal processing, computer vision, projection mapping including LED control, real-time reaction and control for stage and beyond [29,34,[41][42][43].
ISS and its open-source backend core OpenISS [44] rely on computer vision techniques and machine learning provided by OpenCV and MARF; motion capture libraries for Kinect depth cameras and others, sound control, input from voice and music, and augmented and virtual reality components to co-create either augmented performance or have an installation or film, or use as an education tool for artists [43] or children.
"Projected Reality" We explore an idea of a scalable management, visualization,and evaluation of digital evidence in the context for cybercrime investigation with extensions to the interactive 3D documentary subsystem of the Illimitable Space System (ISSv1) [29]. These modifications would enable investigators to represent and create semantic links among digital evidence within an easy to use interface powered by multimodal interactions including but not limited to eye-gaze, gestures and navigational hardware. That work may scale when properly re-engineered and enhanced to act as an interactive "3D window" into the evidential knowledge base grouped into the semantically linked "bubbles' visually representing the documented evidence. By moving such a contextual window, or rather, navigating within the theoretically illimitable space an investigator can sort out and reorganize the knowledge items as needed prior launching the reasoning computation. The interaction design aspect would be of a particular usefulness to open up the documented case knowledge and link the relevant witness accounts and group the related knowledge together. This is a proposed solution to the large-scale visualization problem of large volumes of "scrollable" evidence that does not need to be all visualized at once but behave like a snapshot of a storage depot [1].
As an example, stills from the actual ISSv1 installation hosting multimedia data (documentary videos) users can call out by voice or gestures to examine the contents as in Figure 3 3 . We propose to reorganize the latter into more structured spaces so that the investigators can create semantic links to group the relevant evidences together and for subsequent evaluation by the distributed GIPSY's backend engine [1]. As exemplified in ISSv1 the interactions here are projected on a wall/screen or appear on a monitor. Currently, the viewable scene/window is sequentially loaded and unloaded from the viewing device (PCs, laptops, or VR headsets) to prevent memory overload. The access is on demand by the device and the design is similar to RAM swapping by an operating system to support virtual memory and particularly in this case a distributed storage with evidential data. Available gesture-based interactions using Kinect and similar depth cameras with OpenCV are the enabling HCI aspects for the investigator to link the evidential items in the 3D space. The gesture-based interactions provide optional assistance by the voice-based controls for speech processing and the corresponding commands to view the evidence in detail. Modern availability of VR headsets and VR phone applications make this process even more accessible, although the storage, space and bandwidth requirements have higher constraints, to begin with. In our general approach, we propose an architecture to enable interactive visual windowing into the digital evidence processing as an investigator aid tool. Thus, the preferred method of interaction during analysis and human insight phases prior to or after distributed processing of the evidence and event reconstruction algorithms. Virtual and Augmented Reality Virtual Reality (VR) [45][46][47] is defined in [48] as "a three-dimensional simulation of the real world or an imaginary world allowing the user to have a sense of physical presence and to manipulate 3D objects, in real-time, inside three-dimensional computer-generated environments." In [49], authors point out the possibility of exhibiting concepts that a user might not be able to view otherwise and the immersive nature of VR can aid in education thus, can be inferred for investigators as well.
Augmented Reality (AR) has to do with overlaying virtual objects on top of the real ones and a possibility with gesture or gaze based interaction with these objects while maintaining a grasp on the real world without complete immersion (avoiding nausea and other related VR Figure 4: ISSv3 Examples of th VR environment and some digital content [34] issues).
The real benefit is when both techniques can be combined. ISSv3 in our case was being developing incorporating augmented and virtual reality techniques [7,34]. We experimented in doing both mobile and desktop version of the mixed reality documentary and recording functionality in Unity some of which is visualized in Figure 4 and in Figure 5.

Concluding Remarks
Moving towards our goal to have a visual 3D DFG-based tool that can model Forensic Lucid case specification, and above discussed choices that provide the abilities to do the same in their own ways we attempt to build upon related research work in this area. However, we do consider the potential of the recent work in virtual reality and augmented reality along with different multimodal interaction techniques that seem most consistent with our aim. So far, Ding's work on Graphviz, Puckette's PureData, BPEL and the ISS have drawn our interest and all of them are sound and formally backed standards with some exposure in the industry. While the others may require additional work to specify the credibility and correctness of the bidirectional translation between 3D DFG visualization and Forensic Lucid [9].
The drawbacks of PureData and Graphvizs dot are that their languages lack formal semantics specifications with a few semantic notes along with lexical and grammar related structures [17]. Thus, employing any or all of these will require us to provide translation rules and their equivalent semantics to Forensic Lucid as in Jarraya work that provides translations between the UML2.0/SysML state/activity diagrams and probabilities in [50] when translating to PRISM [9]. ISS is the most scalable approach that can aggregate all the others, but requires  significant number of modifications. Given recent advancements in ISSv2 and ISSv3 referenced above including both AR/VR interactions, ISS makes this approach even more appealing and feasible than previously stated [9].