An argumentation-based reasoner to assist digital investigation and attribution of cyber-attacks
File(s)
Published version
Author(s)
Karafili, Erisa
Wang, Linna
Lupu, Emil
Type
Conference Paper
Abstract
We expect an increase in the frequency and severity of cyber-attacks that comes along with the need for efficient security coun- termeasures. The process of attributing a cyber-attack helps to construct efficient and targeted mitigating and preventive security measures. In this work, we propose an argumentation-based reasoner (ABR) as a proof-of-concept tool that can help a forensics analyst during the analysis of forensic evidence and the attribution process. Given the evidence collected from a cyber-attack, our reasoner can assist the analyst during the investigation process, by helping him/her to analyze the evidence and identify who per- formed the attack. Furthermore, it suggests to the analyst where to focus further analyses by giving hints of the missing evidence or new investigation paths to follow. ABR is the first automatic reasoner that can combine both technical and social evidence in the analysis of a cyber-attack, and that can also cope with incomplete and conflicting information. To illustrate how ABR can assist in the analysis and attribution of cyber-attacks we have used examples of cyber-attacks and their analyses as reported in publicly available reports and online literature. We do not mean to either agree or disagree with the analyses presented therein or reach attribution conclusions.
Date Issued
2020-04
Date Acceptance
2019-11-29
Citation
Forensic Science International: Digital Investigation, 2020, 32, pp.1-9
ISSN
2666-2817
Publisher
Elsevier
Start Page
1
End Page
9
Journal / Book Title
Forensic Science International: Digital Investigation
Volume
32
Copyright Statement
©2020 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY-NC-NDlicense (http://creativecommons.org/licenses/by-nc-nd/4.0/)
Sponsor
Commission of the European Communities
Identifier
https://www.sciencedirect.com/science/article/pii/S2666281720300202
Grant Number
746667
Source
DFRWS EU
Subjects
Science & Technology
Technology
Computer Science, Information Systems
Computer Science, Interdisciplinary Applications
Computer Science
Cyber-attacks
Digital investigation
Attribution
Argumentation reasoning
Publication Status
Published
Start Date
2020-03-25
Finish Date
2020-05-29
Coverage Spatial
Oxford
Date Publish Online
2020-04