Improving Forensic Triage Efficiency through Cyber Threat Intelligence

The complication of information technology and the proliferation of heterogeneous security devices that produce increased volumes of data coupled with the ever-changing threat landscape challenges have an adverse impact on the efficiency of information security controls and digital forensics, as wel...

Full description

Saved in:

Bibliographic Details
Published in:	Future internet Vol. 11; no. 7; p. 162
Main Authors:	Serketzis, Nikolaos, Katos, Vasilios, Ilioudis, Christos, Baltatzis, Dimitrios, Pangalos, Georgios
Format:	Journal Article
Language:	English
Published:	Basel MDPI AG 01-07-2019
Subjects:	Compromises Computer forensics Computer simulation digital forensic readiness digital forensics Evaluation Forensic computing Forensic sciences forensic triage Information systems Intelligence gathering Internet Malware Researchers Security management Security services Threat evaluation threat hunting threat intelligence
Online Access:	Get full text
Tags:	Add Tag No Tags, Be the first to tag this record!

Description
Summary:	The complication of information technology and the proliferation of heterogeneous security devices that produce increased volumes of data coupled with the ever-changing threat landscape challenges have an adverse impact on the efficiency of information security controls and digital forensics, as well as incident response approaches. Cyber Threat Intelligence (CTI)and forensic preparedness are the two parts of the so-called managed security services that defendants can employ to repel, mitigate or investigate security incidents. Despite their success, there is no known effort that has combined these two approaches to enhance Digital Forensic Readiness (DFR) and thus decrease the time and cost of incident response and investigation. This paper builds upon and extends a DFR model that utilises actionable CTI to improve the maturity levels of DFR. The effectiveness and applicability of this model are evaluated through a series of experiments that employ malware-related network data simulating real-world attack scenarios. To this extent, the model manages to identify the root causes of information security incidents with high accuracy (90.73%), precision (96.17%) and recall (93.61%), while managing to decrease significantly the volume of data digital forensic investigators need to examine. The contribution of this paper is twofold. First, it indicates that CTI can be employed by digital forensics processes. Second, it demonstrates and evaluates an efficient mechanism that enhances operational DFR.
ISSN:	1999-5903 1999-5903
DOI:	10.3390/fi11070162