2019/04/30 by Erisa Karafili, Karafili, Erisa, Linna Wang +3
Computer Science · #Advanced Malware Detection Techniques #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Information and Cyber Security
paper · pdf · doi:10.48550/arxiv.1904.13173
openalex publication_date 2019/04/30 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
We expect an increase in the frequency and severity of cyber-attacks that\ncomes along with the need for efficient security countermeasures. The process\nof attributing a cyber-attack helps to construct efficient and targeted\nmitigating and preventive security measures. In this work, we propose an\nargumentation-based reasoner (ABR) as a proof-of-concept tool that can help a\nforensics analyst during the analysis of forensic evidence and the attribution\nprocess. Given the evidence collected from a cyber-attack, our reasoner can\nassist the analyst during the investigation process, by helping him/her to\nanalyze the evidence and identify who performed the attack. Furthermore, it\nsuggests to the analyst where to focus further analyses by giving hints of the\nmissing evidence or new investigation paths to follow. ABR is the first\nautomatic reasoner that can combine both technical and social evidence in the\nanalysis of a cyber-attack, and that can also cope with incomplete and\nconflicting information. To illustrate how ABR can assist in the analysis and\nattribution of cyber-attacks we have used examples of cyber-attacks and their\nanalyses as reported in publicly available reports and online literature. We do\nnot mean to either agree or disagree with the analyses presented therein or\nreach attribution conclusions.\n