Atefi, Soodeh, Panda, Sakshyam, Panaousis, Emmanouil ORCID: 0000-0001-7306-4062 and Laszka, Aron (2023) Principled data-driven decision support for cyber-forensic investigations. In: Thirty-Seventh AAAI Conference on Artificial Intelligence. Association for the Advancement of Artificial Intelligence and The MIT Press (AAAI Press), Palo Alto, California USA, pp. 5010-5017. ISBN 9781577358800 ISSN 2159-5399 (Print), 2374-3468 (Online) (doi:https://doi.org/10.1609/aaai.v37i4.25628)

Preview

PDF (AAM) 38223_PANAOUSIS_Principled_data_driven_decision_support_for_cyber_forensic_investigations.pdf - Accepted Version Download (8MB) | Preview

Abstract

In the wake of a cybersecurity incident, it is crucial to promptly discover how the threat actors breached security in order to assess the impact of the incident and to develop and deploy countermeasures that can protect against further attacks. To this end, defenders can launch a cyber-forensic investigation, which discovers the techniques that the threat actors used in the incident. A fundamental challenge in such an investigation is prioritizing the investigation of particular techniques since the investigation of each technique requires time and effort, but forensic analysts cannot know which ones were actually used before investigating them. To ensure prompt discovery, it is imperative to provide decision support that can help forensic analysts with this prioritization. A recent study demonstrated that data-driven decision support, based on a dataset of prior incidents, can provide stateof-the-art prioritization. However, this data-driven approach, called DISCLOSE, is based on a heuristic that utilizes only a subset of the available information and does not approximate optimal decisions. To improve upon this heuristic, we introduce a principled approach for data-driven decision support for cyber-forensic investigations. We formulate the decision support problem using a Markov decision process, whose states represent the states of a forensic investigation. To solve the decision problem, we propose a Monte Carlo tree search based method, which relies on a k-NN regression over prior incidents to estimate state-transition probabilities. We evaluate our proposed approach on multiple versions of the MITRE ATT&CK dataset, which is a knowledge base of adversarial techniques and tactics based on real-world cyber incidents, and demonstrate that our approach outperforms DISCLOSE in terms of techniques discovered per effort spent.

Item Type:	Conference Proceedings
Title of Proceedings:	Thirty-Seventh AAAI Conference on Artificial Intelligence
Uncontrolled Keywords:	cyber security; Artificial Intelligence (AI); cyber forensics, ATT&CK
Subjects:	Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Faculty / School / Research Centre / Research Group:	Faculty of Engineering & Science Faculty of Engineering & Science > Internet of Things and Security Research Centre (ISEC) Faculty of Engineering & Science > School of Computing & Mathematical Sciences (CMS)
Related URLs:	Publisher
Last Modified:	07 Jul 2023 13:26
URI:	http://gala.gre.ac.uk/id/eprint/38223

Actions (login required)

View Item

Downloads