ECOSYSTEM OF INSTALLED MOBILE APPLICATIONS FOR IDENTIFYING BEHAVIORAL GROUPS AND ASSESSING DIGITAL RISK

Abstract

The article investigates the ecosystem of installed mobile applications as a source of behaviorally relevant digital artifacts that can be used for user profiling and digital risk assessment in mobile device forensics. Smartphones accumulate a wide range of application-level traces that reflect user habits, interests, and activity patterns, making the structure of installed apps a valuable indirect indicator of behavioral characteristics. The study proposes a methodological framework that transforms application lists into a structured representation of user profiles based on proportional distributions of app categories. Using a dataset of anonymized screenshots collected from 100 participants, each mobile application was classified into a unified taxonomy of categories, enabling the construction of “user–category” behavioral vectors. To identify latent groups of digital behavior, k-means clustering was applied with prior normalization and validated using silhouette metrics. Dimensionality reduction through PCA allowed visualizing cluster separation and exploring structural differences between users. The results reveal two distinct behavioral groups with clearly different application ecosystems: one dominated by financial, governmental, security-oriented, and cryptocurrency apps; the other characterized by broader multimedia, utility, productivity, and personalization tools. A digital risk score was introduced to quantify potential forensic relevance based on the presence of high-risk app categories such as VPN services, anonymization tools, secure messengers, and cryptocurrency platforms. Comparative analysis shows that the first cluster demonstrates substantially higher risk levels, indicating potentially more complex forensic reconstruction scenarios. The study demonstrates that analyzing installed mobile applications enables effective behavioral segmentation, uncovering latent usage patterns and supporting forensic evaluation of digital risk. The proposed methodology offers a scalable approach for integrating application-based analysis into mobile forensics workflows and highlights directions for future work, including expanded datasets, incorporation of temporal usage patterns, and advanced machine-learning models for behavioral interpretation.