The use of anti-forensic techniques is a very common practice that stealthy adversaries may deploy to minimise their traces and make the investigation of an incident harder by evading detection and attribution. In this paper, we study the interaction between a cyber forensic Investigator and a strategic Attacker using a game-theoretic framework. This is based on a Bayesian game of incomplete information played on a multi-host cyber forensics investigation graph of actions traversed by both players. The edges of the graph represent players’ actions across different hosts in a network. In alignment with the concept of Bayesian games, we define two Attacker types to represent their ability of deploying anti-forensic techniques to conceal their activities. In this way, our model allows the Investigator to identify the optimal investigating policy taking into consideration the cost and impact of the available actions, while coping with the uncertainty of the Attacker’s type and strategic decisions. To evaluate our model, we construct a realistic case study based on threat reports and data extracted from the MITRE ATT&CK STIX repository, Common Vulnerability Scoring System (CVSS), and interviews with cyber-security practitioners. We use the case study to compare the performance of the proposed method against two other investigative methods and three different types of Attackers.

中文翻译：

---

网络取证调查的理论决策支持

反取证技术的使用是一种非常普遍的做法，隐蔽的对手可能会部署这些技术来最大限度地减少他们的踪迹，并通过逃避检测和归因使事件调查变得更加困难。在本文中，我们使用博弈论框架研究网络取证调查员和战略攻击者之间的相互作用。这是基于在多主机网络取证调查图上播放的不完整信息的贝叶斯游戏，该游戏由两个玩家遍历的动作构成。图的边代表玩家在网络中不同主机上的动作。根据贝叶斯游戏的概​​念，我们定义了两种攻击者类型来表示他们部署反取证技术来隐藏其活动的能力。通过这种方式，我们的模型允许调查员在考虑可用行动的成本和影响的情况下确定最佳调查策略，同时应对攻击者类型和战略决策的不确定性。为了评估我们的模型，我们根据威胁报告和从 MITRE ATT&CK STIX 存储库中提取的数据、通用漏洞评分系统 (CVSS) 以及对网络安全从业者的采访构建了一个现实案例研究。我们使用案例研究来比较所提出的方法与其他两种调查方法和三种不同类型的攻击者的性能。我们基于威胁报告和从 MITRE ATT&CK STIX 存储库、通用漏洞评分系统 (CVSS) 中提取的数据以及对网络安全从业者的采访构建了一个现实的案例研究。我们使用案例研究来比较所提出的方法与其他两种调查方法和三种不同类型的攻击者的性能。我们基于威胁报告和从 MITRE ATT&CK STIX 存储库、通用漏洞评分系统 (CVSS) 中提取的数据以及对网络安全从业者的采访构建了一个现实的案例研究。我们使用案例研究来比较所提出的方法与其他两种调查方法和三种不同类型的攻击者的性能。