Leveraging reinforcement learning for an efficient windows registry analysis during cyber incident response

Area of Science:

• Digital Forensics
• Artificial Intelligence
• Computer Science

Background:

• Microsoft Windows is the dominant desktop OS, making its Registry a key focus for digital forensic investigations.
• Analyzing the Windows Registry is crucial for reconstructing incidents, but faces challenges due to data scale and time pressure.
• Existing methods struggle with the complexity and volume of Registry data, necessitating advanced analytical tools.

Purpose of the Study:

• To present WinRegRL, a hybrid AI framework for automated Windows Registry and timeline-centered forensic analysis.
• To improve the efficiency and effectiveness of digital investigations in time-critical scenarios.
• To provide a reproducible and explainable decision-support mechanism for incident response.

Main Methods:

• Developed WinRegRL, a hybrid framework combining Markov Decision Process (MDP) with dynamic programming and bounded Reinforcement Learning (RL).
• Modeled the investigation process as an MDP with defined states, actions, transitions, and rewards, incorporating expert policy graphs.
• Utilized bounded RL for local refinement in low-support state-action regions, positioning it as an MDP approach with RL refinement.

Main Results:

• WinRegRL reduced investigation time by up to 68% in evaluated datasets.
• The framework increased the identification of relevant artifacts by up to 35% with high precision.
• Demonstrated improved investigation efficiency and strong evidential coverage in tested scenarios.

Conclusions:

• WinRegRL offers a promising decision-support framework for large-scale, time-critical Windows incident response.
• The hybrid AI approach enhances forensic analysis by automating key investigative tasks.
• The framework provides a reproducible and explainable method for improving digital investigation outcomes.