.png){kind=icon}
返回
Data-Driven Decision Support for Optimizing Cyber Forensic Investigations
.png){kind=icon}
OA
AI
DOI：10.1109/TIFS.2021.3054966.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Cyber attacks consisting of several attack actions can present considerable challenge to forensic investigations. Consider the case where a cybersecurity breach is suspected following the discovery of one attack action, for example by observing the modification of sensitive registry keys, suspicious network traffic patterns, or the abuse of legitimate credentials. At this point, the investigator can have multiple options as to what to check next to discover the rest, and will likely pick one based on experience and training. This will be the case at each new step. We argue that the efficiency of this aspect of the job, which is the selection of what next step to take, can have significant impact on its overall cost (e.g., the duration) of the investigation and can be improved through the application of constrained optimization techniques. Here, we present DISCLOSE, the first data-driven decision support framework for optimizing forensic investigations of cybersecurity breaches. DISCLOSE benefits from a repository of known adversarial tactics, techniques, and procedures (TTPs), for each of which it harvests threat intelligence information to calculate its probabilistic relations with the rest. These relations, as well as a proximity parameter derived from the projection of quantitative data regarding the adversarial TTPs on an attack life cycle model, are both used as input to our optimization framework. We show the feasibility of this approach in a case study that consists of 31 adversarial TTPs, data collected from 6 interviews with experienced cybersecurity professionals and data extracted from the MITRE ATT&CK STIX repository and the Common Vulnerability Scoring System (CVSS).
Keyword:
Forensics
Cognition
Computer security
Probabilistic logic
Optimization
Correlation
Guidelines
Cyber forensics
digital forensics
multi-stage attacks
decision support
optimization
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
From Intrusion Detection to Attacker Attribution: A Comprehensive Survey of Unsupervised Methods从入侵检测到攻击者归因: 无监督方法的综合考察OAAI
OAAI分享收藏
Compelexes de la ferrotetraphenylporphyrine avec des chlorocarbenes porteurs d'un groupement electroattracteur: Fer(II)(TPP)(CClA), A = CN ou COOC2H5四苯基四苯基铁卟啉化合物电子吸引子: Fer(II)(TPP)(CClA)，A = CN ou COOC2H5
PREAI
分享收藏APT datasets and attack modeling for automated detection methods: A review.png)
COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏
查看更多内容