Game-Theoretic Decision Support for Cyber Forensic Investigations

Area of Science:

• Cybersecurity
• Game Theory
• Digital Forensics

Background:

• Adversaries commonly use anti-forensic techniques to evade detection and hinder investigations.
• Investigating cyber incidents is complex due to attacker evasion strategies.

Purpose of the Study:

• To develop a game-theoretic framework modeling the interaction between a cyber forensic investigator and a strategic attacker.
• To enable investigators to determine optimal policies considering costs, impacts, and attacker uncertainty.

Main Methods:

• A Bayesian game of incomplete information is employed on a multi-host cyber forensics investigation graph.
• Two attacker types are defined to represent varying capabilities in deploying anti-forensic techniques.
• A realistic case study using MITRE ATT&CK, CVSS, and practitioner interviews validates the model.

Main Results:

• The proposed model provides an optimal investigating policy for investigators facing uncertainty about attacker types and strategies.
• The model's effectiveness is demonstrated through comparison with existing investigative methods in a realistic scenario.

Conclusions:

• Game theory offers a robust framework for analyzing and improving cyber forensic investigations.
• Understanding attacker anti-forensic strategies is crucial for developing effective defense and investigation policies.