Forensic Profiling of Cyber-Security Adversaries based on Incident Similarity Measures Interaction Index

Abstract

In today’s complex cyber space, forecasting the likelihood or probability that a Cyber Security Adversary (CSA) is likely to attack a given infrastructure, system or a networked environment requires a critical analysis of digital data that at that particular time is treated as potential evidence. Digital forensic tools have more often than not been employed in such tasks, however, this aspect has often faced a number of uncertainties. This paper addresses the lack of effective techniques of profiling CSAs in order to discover adversarial motives based on incident similarity measure metrics. The authors of this paper propose an approach that uses an Incident Similarity Measure Interaction Index (ISMII) metric, through which, for example, two independent Cyber Security Incidents (CSI) can be measured and be correlated in order to link a digital crime to the perpetrator. By realising such measures using the ISMII metric, digital forensic investigators are able to profile, predict, and correlate CSI patterns with a degree of certainty. The result of the study depicts a new ISMII metric that is able to compute closely matching cyber-security based incidents.