Principled Data-Driven Decision Support for Cyber-Forensic Investigations

• URL: http://arxiv.org/abs/2211.13345v1
• Date: Wed, 23 Nov 2022 23:18:56 GMT
• Title: Principled Data-Driven Decision Support for Cyber-Forensic Investigations
• Authors: Soodeh Atefi, Sakshyam Panda, Manos Panaousis, Aron Laszka
• Abstract summary: We introduce a principled approach for data-driven decision support for cyber-forensic investigations. We propose a Monte Carlo tree search based method, which relies on a k-NN regression over prior incidents to estimate state-transition probabilities. We evaluate our proposed approach on multiple versions of the MITRE ATT&CK dataset.
• Score: 3.2823784475650077
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In the wake of a cybersecurity incident, it is crucial to promptly discover how the threat actors breached security in order to assess the impact of the incident and to develop and deploy countermeasures that can protect against further attacks. To this end, defenders can launch a cyber-forensic investigation, which discovers the techniques that the threat actors used in the incident. A fundamental challenge in such an investigation is prioritizing the investigation of particular techniques since the investigation of each technique requires time and effort, but forensic analysts cannot know which ones were actually used before investigating them. To ensure prompt discovery, it is imperative to provide decision support that can help forensic analysts with this prioritization. A recent study demonstrated that data-driven decision support, based on a dataset of prior incidents, can provide state-of-the-art prioritization. However, this data-driven approach, called DISCLOSE, is based on a heuristic that utilizes only a subset of the available information and does not approximate optimal decisions. To improve upon this heuristic, we introduce a principled approach for data-driven decision support for cyber-forensic investigations. We formulate the decision-support problem using a Markov decision process, whose states represent the states of a forensic investigation. To solve the decision problem, we propose a Monte Carlo tree search based method, which relies on a k-NN regression over prior incidents to estimate state-transition probabilities. We evaluate our proposed approach on multiple versions of the MITRE ATT&CK dataset, which is a knowledge base of adversarial techniques and tactics based on real-world cyber incidents, and demonstrate that our approach outperforms DISCLOSE in terms of techniques discovered per effort spent.

Related papers

• CTISum: A New Benchmark Dataset For Cyber Threat Intelligence Summarization [14.287652216484863]
  We present CTISum, a new benchmark for CTI summarization task. Considering the importance of attack process, a novel fine-grained subtask of attack process summarization is proposed.
  arXiv  Detail & Related papers  (2024-08-13T02:25:16Z)
• Privacy-Preserving State Estimation in the Presence of Eavesdroppers: A Survey [10.366696004684822]
  Networked systems are increasingly the target of cyberattacks. Eavesdropping attacks aim to infer information by collecting system data and exploiting it for malicious purposes. It is crucial to protect disclosed system data to avoid an accurate state estimation by eavesdroppers.
  arXiv  Detail & Related papers  (2024-02-24T06:32:07Z)
• Online Decision Mediation [72.80902932543474]
  Consider learning a decision support assistant to serve as an intermediary between (oracle) expert behavior and (imperfect) human behavior. In clinical diagnosis, fully-autonomous machine behavior is often beyond ethical affordances.
  arXiv  Detail & Related papers  (2023-10-28T05:59:43Z)
• Re-thinking Data Availablity Attacks Against Deep Neural Networks [53.64624167867274]
  In this paper, we re-examine the concept of unlearnable examples and discern that the existing robust error-minimizing noise presents an inaccurate optimization objective. We introduce a novel optimization paradigm that yields improved protection results with reduced computational time requirements.
  arXiv  Detail & Related papers  (2023-05-18T04:03:51Z)
• On the Privacy Risks of Algorithmic Recourse [17.33484111779023]
  We make the first attempt at investigating if and how an adversary can leverage recourses to infer private information about the underlying model's training data. Our work establishes unintended privacy leakage as an important risk in the widespread adoption of recourse methods.
  arXiv  Detail & Related papers  (2022-11-10T09:04:24Z)
• Inverse Online Learning: Understanding Non-Stationary and Reactionary Policies [79.60322329952453]
  We show how to develop interpretable representations of how agents make decisions. By understanding the decision-making processes underlying a set of observed trajectories, we cast the policy inference problem as the inverse to this online learning problem. We introduce a practical algorithm for retrospectively estimating such perceived effects, alongside the process through which agents update them. Through application to the analysis of UNOS organ donation acceptance decisions, we demonstrate that our approach can bring valuable insights into the factors that govern decision processes and how they change over time.
  arXiv  Detail & Related papers  (2022-03-14T17:40:42Z)
• A2Log: Attentive Augmented Log Anomaly Detection [53.06341151551106]
  Anomaly detection becomes increasingly important for the dependability and serviceability of IT services. Existing unsupervised methods need anomaly examples to obtain a suitable decision boundary. We develop A2Log, which is an unsupervised anomaly detection method consisting of two steps: Anomaly scoring and anomaly decision.
  arXiv  Detail & Related papers  (2021-09-20T13:40:21Z)
• NERD: Neural Network for Edict of Risky Data Streams [0.0]
  Cyber incidents can have a wide range of cause from a simple connection loss to an insistent attack. The developed system is enriched with information by multiple sources such as intrusion detection systems and monitoring tools. It uses over twenty key attributes like sync-package ratio to identify potential security incidents and to classify the data into different priority categories.
  arXiv  Detail & Related papers  (2020-07-08T14:24:48Z)
• Anomalous Example Detection in Deep Learning: A Survey [98.2295889723002]
  This survey tries to provide a structured and comprehensive overview of the research on anomaly detection for Deep Learning applications. We provide a taxonomy for existing techniques based on their underlying assumptions and adopted approaches. We highlight the unsolved research challenges while applying anomaly detection techniques in DL systems and present some high-impact future research directions.
  arXiv  Detail & Related papers  (2020-03-16T02:47:23Z)
• Survey of Network Intrusion Detection Methods from the Perspective of the Knowledge Discovery in Databases Process [63.75363908696257]
  We review the methods that have been applied to network data with the purpose of developing an intrusion detector. We discuss the techniques used for the capture, preparation and transformation of the data, as well as, the data mining and evaluation methods. As a result of this literature review, we investigate some open issues which will need to be considered for further research in the area of network security.
  arXiv  Detail & Related papers  (2020-01-27T11:21:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.