Cyber Attribution: An Argumentation-Based Approach

Abstract

Attributing a cyber-operation through the use of multiple pieces of technical evidence (i.e., malware reverse-engineering and source tracking) and conventional intelligence sources (i.e., human or signals intelligence) is a difficult problem not only due to the effort required to obtain evidence, but the ease with which an adversary can plant false evidence. In this paper, we introduce a formal reasoning system called the InCA (Intelligent Cyber Attribution) framework that is designed to aid an analyst in the attribution of a cyber-operation even when the available information is conflicting and/or uncertain. Our approach combines argumentationbased reasoning, logic programming, and probabilistic models to not only attribute an operation but also explain to the analyst why the system reaches its conclusions.

A Formal Approach to Analyzing Cyber-Forensics Evidence

“…Rule D ′′ 1 cannot be applied. Rule D ′′ 2 is applied, as shown in (14)- (15), to the conflicting pieces of evidence where the reasonings' trust relations apply. Finally, L ′ 1 transforms all third layer formulas into second layer ones:…”

“…To the best of our knowledge, the only attempt at using belief revision during cyber-attacks' investigations is [15,16], where a probabilistic structure argumentation framework is used to analyze contradictory and uncertain data. Our procedure does not deal with probabilities, but with preferences between sources and reasoning rules.…”

An approach to characterize graded entailment of arguments through a label-based framework

“…In a similar fashion, probabilistic argumentation frameworks can be divided into those that arise from extending abstract models [69,70,71] and others based on incorporating probabilities in structured frameworks-the earliest such works appeared almost two decades ago [72,73], followed by a period of inactivity and a recent resurgence of interest in the topic [74,9,75]. Clearly, our work is closest in spirit to the latter, since labels can be seen as a generalization of probability values associated with items in the knowledge base-the generalization is not, however, a complete subsumption since the algebra in this case would simply model a probabilistic space; the modeling of the corresponding probability distribution needs to reside elsewhere, as done in the works mentioned above.…”

“…In a general sense, argumentation can be defined as the study of the interaction among arguments for and against conclusions, with the purpose of determining which conclusions are acceptable in order to use such claims to resolve real-world problems. Argumentation tools are applied in many areas such as legal reasoning [1,2], intelligent web search [3,4], recommender systems [5,6], autonomous agents and multiagent systems [7,8], cyber-security [9], and many others [10,11,12].…”

Multi-agent Systems for Dynamic Forensic Investigation

“…Shakarian et al [7] described a cyber attribution system [8], [9] that takes into consideration different data sources and uses MAS to reason about the origin of an attack through the use of agent reasoning. The system uses information gathered about the attack as well as information gathered from a wide range of military sources to reason in-depth about the attribution of an attack.…”