Improving Forensic Triage Efficiency through Cyber Threat Intelligence

Abstract

The complication of information technology and the proliferation of heterogeneous security devices that produce increased volumes of data coupled with the ever-changing threat landscape challenges have an adverse impact on the efficiency of information security controls and digital forensics, as well as incident response approaches. Cyber Threat Intelligence (CTI)and forensic preparedness are the two parts of the so-called managed security services that defendants can employ to repel, mitigate or investigate security incidents. Despite their success, there is no known effort that has combined these two approaches to enhance Digital Forensic Readiness (DFR) and thus decrease the time and cost of incident response and investigation. This paper builds upon and extends a DFR model that utilises actionable CTI to improve the maturity levels of DFR. The effectiveness and applicability of this model are evaluated through a series of experiments that employ malware-related network data simulating real-world attack scenarios. To this extent, the model manages to identify the root causes of information security incidents with high accuracy (90.73%), precision (96.17%) and recall (93.61%), while managing to decrease significantly the volume of data digital forensic investigators need to examine. The contribution of this paper is twofold. First, it indicates that CTI can be employed by digital forensics processes. Second, it demonstrates and evaluates an efficient mechanism that enhances operational DFR.

Security Challenges and Cyber Forensic Ecosystem in IoT Driven BYOD Environment

“…Extended next level research was also conducted in 2019 which was improved version in the study of "A Generic Digital Forensic Readiness Model for BYOD using Honeypot Technology [23]". Also in same direction Intelligent Threat Platform was another study for detecting the incident where accuracy has been analyzed [25]. To increases the accuracy level of malicious activities using audit logs collected from Intelligent Threat sources, accuracy has been analyzed as 90.73%, 96.16 and 93.71% [25].…”

“…Also in same direction Intelligent Threat Platform was another study for detecting the incident where accuracy has been analyzed [25]. To increases the accuracy level of malicious activities using audit logs collected from Intelligent Threat sources, accuracy has been analyzed as 90.73%, 96.16 and 93.71% [25].…”

Study on Inside Threats Based on Analytic Hierarchy Process

“…Based on this naive approach, Eberle et al [41] proposed a detector algorithm that applied the graph-based anomaly detection technique, as well as an anomalous insertion, modification, and deletion environment. The authors derived the main features, such as the calculation of real intelligence specific [42] to malicious insiders, and directed their focus towards the capture of insiders in the real world. The authors also derived the formation of synthetic security data applicable to each organization, involving reasonable computational overhead due to the improved algorithm.…”

A Comprehensive Survey on Computer Forensics: State-of-the-Art, Tools, Techniques, Challenges, and Future Directions

“…The attack lasted for three weeks, disrupting emails, real estate sales, water bills, health alerts, and several other services. The annual cost of suffering is increasing rapidly; in fact, the experts have projected it to rise to $6 trillion by 2021 1 [5], [6], [7]. Computer forensics techniques are used in civil, administrative, and criminal cases; however, an intelligent selection of tools is vital in criminal investigations.…”