AF-Cyber · Logic-based Attribution and Forensics in Cyber Security

Logic-based Attribution and Forensics in Cyber Security

The AF-Cyber (Logic-based Attribution and Forensics in Cyber Security) project has studied the problem of attribution and digital investigation of cyber-attacks. The investigation of cyber-attacks is the process performed by cyber-security experts and forensics investigators, where the main goals are to identify, acquire, store, and analyse the evidence left after a cyber-attack. Performing a correct and swift investigation is crucial, as it permits to understand the vulnerabilities exploited, to put in place mitigative and preventive countermeasures, and discover who may be responsible the attack; this latter process is called attribution. Analysing and attributing cyber-attacks is a difficult process as the evidence gathered may be contradictory especially when attackers use anti-forensics and deceptive techniques. Currently, attribution of cyber-attacks is mainly a manual process, performed by the forensic investigators, and is strictly bound by the knowledge of the investigator. Thus, is easily human biased and error-prone. Furthermore, investigators need to deal with an enormous amount of data that requires filtering, classification, and analysis. AF-Cyber worked on formal methods and AI techniques that help the forensics investigators during the analysis and attribution of cyber-attacks. AF-Cyber developed a novel logic-based automatic reasoner, that given the cyber forensics evidence of an attack and information about its social aspects can assist the forensic investigators during the analysis and attribution process. AF-Cyber alleviates the work of the investigators as it: provides a solution for filtering the enormous amount of evidence; enables the investigator to identify a set of evidence that is consistent; allows to dynamically pinpoint new evidence that could be collected to reach more precise conclusions. Specifically, the main project objectives have been: 1) Construct a knowledge base evidence and rules for attribution in cyber-attacks 2 & 3) Develop an automatic logic-based reasoner for representing and reasoning about attribution and provide support to the analyst 4) Design a methodology for dynamic forensic evidence collection AF-Cyber’s main results are: • Reducing the used resources during cyber-attack investigation using a novel technique to filter the collected evidence; • Performing a rapid and goal-oriented analysis of the evidence left after an attack using a new automatic reasoner; • This reasoner suggests to the user further evidence to be collected and enables investigators to share lessons learned across investigations; • Novel methodologies to identify threat models and vulnerabilities; • Innovative security solutions based on argumentation reasoning. AF-Cyber worked on a real problem that our society (on a global level) is currently facing, i.e., preventing, mitigating, and attributing cyber-attacks. This problem will continue to persist in the future, given the increase of interconnectivity in our everyday life and the sophistication of cyber-attacks. AF-Cyber focused on swiftly identifying and analysing the evidence left after an attack. The results of AF-Cyber will not replace the analyst, as his/her knowledge is crucial but will assist the analyst towards achieving faster and more precise conclusions. AF-Cyber results play an important role in reducing human errors and possible biases as it permits to share lessons learned from past experiences. AF-Cyber solutions will help the analysts to conduct a swift and efficient analysis and attribution, that would permit to put in act efficient mitigative and preventive measures against attacks, and to put in place attacker-oriented countermeasures.

Текст от CORDIS, на английски · Данни: CORDIS, © Европейски съюз