The AF-Cyber (Logic-based Attribution and Forensics in Cyber Security) project has studied the problem of attribution and digital investigation of cyber-attacks. The investigation of cyber-attacks is the process performed by cyber-security experts and forensics investigators, where the main goals are to identify, acquire, store, and analyse the evidence left after a cyber-attack. Performing a correct and swift investigation is crucial, as it permits to understand the vulnerabilities exploited, to put in place mitigative and preventive countermeasures, and discover who may be responsible the attack; this latter process is called attribution.
Analysing and attributing cyber-attacks is a difficult process as the evidence gathered may be contradictory especially when attackers use anti-forensics and deceptive techniques. Currently, attribution of cyber-attacks is mainly a manual process, performed by the forensic investigators, and is strictly bound by the knowledge of the investigator. Thus, is easily human biased and error-prone. Furthermore, investigators need to deal with an enormous amount of data that requires filtering, classification, and analysis.
AF-Cyber worked on formal methods and AI techniques that help the forensics investigators during the analysis and attribution of cyber-attacks. AF-Cyber developed a novel logic-based automatic reasoner, that given the cyber forensics evidence of an attack and information about its social aspects can assist the forensic investigators during the analysis and attribution process. AF-Cyber alleviates the work of the investigators as it: provides a solution for filtering the enormous amount of evidence; enables the investigator to identify a set of evidence that is consistent; allows to dynamically pinpoint new evidence that could be collected to reach more precise conclusions.
Specifically, the main project objectives have been:
1) Construct a knowledge base evidence and rules for attribution in cyber-attacks
2 & 3) Develop an automatic logic-based reasoner for representing and reasoning about attribution and provide support to the analyst
4) Design a methodology for dynamic forensic evidence collection
AF-Cyber’s main results are:
• Reducing the used resources during cyber-attack investigation using a novel technique to filter the collected evidence;
• Performing a rapid and goal-oriented analysis of the evidence left after an attack using a new automatic reasoner;
• This reasoner suggests to the user further evidence to be collected and enables investigators to share lessons learned across investigations;
• Novel methodologies to identify threat models and vulnerabilities;
• Innovative security solutions based on argumentation reasoning.
AF-Cyber worked on a real problem that our society (on a global level) is currently facing, i.e. preventing, mitigating, and attributing cyber-attacks. This problem will continue to persist in the future, given the increase of interconnectivity in our everyday life and the sophistication of cyber-attacks. AF-Cyber focused on swiftly identifying and analysing the evidence left after an attack. The results of AF-Cyber will not replace the analyst, as his/her knowledge is crucial but will assist the analyst towards achieving faster and more precise conclusions. AF-Cyber results play an important role in reducing human errors and possible biases as it permits to share lessons learned from past experiences. AF-Cyber solutions will help the analysts to conduct a swift and efficient analysis and attribution, that would permit to put in act efficient mitigative and preventive measures against attacks, and to put in place attacker-oriented countermeasures.
