Principled Data-Driven Decision Support for Cyber-Forensic Investigations. (arXiv:2211.13345v1 [cs.CR])

In the wake of a cybersecurity incident, it is crucial to promptly discover
how the threat actors breached security in order to assess the impact of the
incident and to develop and deploy countermeasures that can protect against
further attacks. To this end, defenders can launch a cyber-forensic
investigation, which discovers the techniques that the threat actors used in
the incident. A fundamental challenge in such an investigation is prioritizing
the investigation of particular techniques since the investigation of each …

cyber data decision forensic investigations support