An Argumentation-Based Reasoner to Assist Digital Investigation and Attribution of Cyber-Attacks

TL;DR

This paper introduces an argumentation-based reasoner (ABR) that aids cyber-attack investigation by analyzing evidence, handling conflicting information, and suggesting investigation directions, integrating technical and social evidence for attribution.

Contribution

It presents the first automatic reasoner capable of combining technical and social evidence in cyber-attack analysis, even with incomplete or conflicting data.

Findings

ABR can analyze diverse evidence types effectively.

It helps identify attack perpetrators and suggests further investigation paths.

Demonstrated with real-world cyber-attack examples.

Abstract

We expect an increase in the frequency and severity of cyber-attacks that comes along with the need for efficient security countermeasures. The process of attributing a cyber-attack helps to construct efficient and targeted mitigating and preventive security measures. In this work, we propose an argumentation-based reasoner (ABR) as a proof-of-concept tool that can help a forensics analyst during the analysis of forensic evidence and the attribution process. Given the evidence collected from a cyber-attack, our reasoner can assist the analyst during the investigation process, by helping him/her to analyze the evidence and identify who performed the attack. Furthermore, it suggests to the analyst where to focus further analyses by giving hints of the missing evidence or new investigation paths to follow. ABR is the first automatic reasoner that can combine both technical and social evidence in the analysis of a cyber-attack, and that can also cope with incomplete and conflicting information. To illustrate how ABR can assist in the analysis and attribution of cyber-attacks we have used examples of cyber-attacks and their analyses as reported in publicly available reports and online literature. We do not mean to either agree or disagree with the analyses presented therein or reach attribution conclusions.

Figures

Tables

Table 1. Table 1: Some of ABR ’s background knowledge , divided into: general knowledge (yellow) and domain-specific knowledge (orange)

Predicate example	Explanation
industry(infocomm)	Type predicate for industries
polIndustry(military)	Political industries
norIndustry(infocomm)	Non political industries
country(united_states)	Type predicate for countries
cybersuperpower(united_states)	List of cyber superpowers
gci_tier(afghanistan,initiating) gci_tier(poland, maturing) gci_tier(russian_federation,leading)	Global Cybersecurity Index (GCI)
firstLanguage(english, united_states)	First language used in the country
goodRelation(united_states, australia)	Good relations between countries
poorRelation(united_states, north_korea)	Poor relations between countries
prominentGroup(fancyBear)	Prominent hacker groups
groupOrigin(fancyBear, russian_federation)	Country of origin of a group
pastTargets(fancyBear, [france,…,poland])	Past targets of a hacker group
malwareLinked(trojanMiniduke,cozyBear)	Past attribution of malware
malwareUsedInAttack(flame, flameattack)
ccServer(gowin7, flame)	C&C servers of malware
domainRegisteredDetails(gowin7, adolph_dybevek, prinsen_gate_6)	Dom. registration details of C&C servers

Equations

$$rul{e}_i:L\leftarrow L_1,\dots ,L_n$$

$$st{r}_1:isCulprit(C,Att)\leftarrow ClaimResp(C,Att)$$

$$p_i:rul{e}_1>rul{e}_2$$

$$p_1:st{r}_2>st{r}_1$$

$$st{r}_2:\neg isCulprit(X,Att)\leftarrow \neg hasCap(X,Att).$$

$$\begin{array}[]{ll}op_{1}:hasMotive(X,Att)\leftarrow&\ target(T,Att),\ industry(T),\\ &hasEconMot(X,T),\\ &contextOfAtt(econ,Att),\\ &specificTarget(Att).\end{array}$$

$$\begin{array}[]{ll}op_{2}:\neg specificTarget(Att)\leftarrow&target(T_{1},Att),\\ &target(T_{2},Att),T_{1}\neq T_{2}.\end{array}$$

$$t_1:reqHighRes(Att)\leftarrow usesZeroDay(Att).$$

$$\begin{array}[]{ll}op_{3}:hasCap(X,Att)\leftarrow&reqHighRes(Att),\\ &hasResources(X).\end{array}$$

$$\begin{array}[]{ll}str_{3}:isCulprit(X,Att)\leftarrow&hasMotive(X,Att),\\ &hasCap(X,Att).\end{array}$$

$$\begin{array}[]{ll}str_{3}:\ isCulprit(X,Att)\leftarrow&hasMotive(X,Att),\\ &hasCap(X,Att).\\ str_{4}:\ isCulprit(X,Att)\leftarrow&malwareUsed(M1,Att),\\ &similar(M1,M2),\\ &notBlackMarket(M1),\\ &notBlackMarket(M2),\\ &malwareLinked(M2,X).\\ str_{5}:\neg isCulprit(X,Att)\leftarrow&\neg attackOrig(X,Att).\\ str_{6}:\neg isCulprit(X,Att)\leftarrow&target(X,Att).\end{array}$$

$$\begin{array}[]{ll}op_{1}:hasMotive(X,Att)\leftarrow&target(T,Att),\ industry(T),\\ &hasEconMot(X,T),\\ &contextOfAtt(econ,Att),\\ &specificTarget(Att).\end{array}$$

$$\begin{array}[]{ll}op_{3}:hasCap(X,Att)\leftarrow&reqHighRes(Att),\\ &hasResources(X).\end{array}$$

$$\begin{array}[]{ll}t_{2}:reqHighRes(Att)\leftarrow&target(T,Att),\ highSecurity(T).\\ t_{3}:reqHighRes(Att)\leftarrow&highVolAtt(Att),\ longDurAtt(Att).\\ t_{4}:reqHighRes(Att)\leftarrow&highLevelSkill(Att).\\ \end{array}$$

$$\begin{array}[]{l}target(us\_banks,usBHack).\\ targetCountry(usa,usBHack).\\ attackPeriod(usBHack,[2012,9]).\\ highLevelSkill(usBHack).\\ malwareUsed(itsOKnp,usBHack).\\ imposedSanc(usa,iran,[2012,2]).\end{array}$$

$$\begin{array}[]{l}op_{4}:hasPolMotive(C,T,Date)\leftarrow imposedSanc(T,C,Date).\end{array}$$

$$\begin{array}[]{ll}t_{5}:attackPOrig(X,Att)\leftarrow&sysLang(L,Att),\\ &firstLang(L,X).\\ t_{6}:attackPOrig(X,Att)\leftarrow&langInCode(L,Att),\\ &firstLang(L,X).\end{array}$$

$$\begin{array}[]{l}t_{7}:hasResources(X)\leftarrow gci\_tier(X,leading).\\ t_{8}:hasResources(X)\leftarrow cybersuperpower(X).\\ t_{9}:hasNoResources(X)\leftarrow gci\_tier(X,initiating).\end{array}$$

$$\begin{array}[]{ll}op_{3}:hasCap(iran,usBHack)\leftarrow&\ reqHighRes(usBHack),\\ &\ hasResources(iran).\end{array}$$

$$\begin{array}[]{l}op_{5}:\neg hasMotive(C,Att)\leftarrow targetC(T,Att),\ country(T),\\ \qquad\qquad\qquad\qquad\qquad\quad\ \ \ country(C),goodRelation(C,T).\end{array}$$

$$o{p}_6:hasCap(X,Att)\leftarrow prominentGroup(X).$$

$$\begin{array}[]{ll}str_{4}:\ isCulprit(X,A1)\leftarrow&malwareUsed(M1,A1),\\ &similar(M1,M2),\\ &malwareLinked(M2,X),\\ &notBlackMarket(M1),\\ &notBlackMarket(M2).\\ \end{array}$$

$$\begin{array}[]{l}t_{10}:similar(M1,M2)\leftarrow similarCodeObf(M1,M2).\\ t_{11}:similar(M1,M2)\leftarrow sharedCode(M1,M2).\\ t_{12}:similar(M1,M2)\leftarrow modifiedFrom(M1,M2).\\ t_{13}:similar(M1,M2)\leftarrow similarCCServer(M1,M2).\end{array}$$

$$\begin{array}[]{ll}op_{7}:hasMotive(C,Att)\leftarrow&targetCountry(T,Att),\\ &attackPeriod(Att,Date1),\\ &hasPolMotive(C,T,Date2),\\ &specificTarget(Att)\\ &dateApplicable(Date1,Date2).\end{array}$$

Full text

1 Introduction

The increase in cyber-attacks we are currently facing [33] is expected to continue, especially given the exponential increase in the usage of IoT and smart devices, which drastically increases the attack surface of systems. The increasing dependency users have on these connected devices raises the users’ exposure to cyber-attacks. The growth in frequency and severity of cyber-attacks comes along with the increased economic costs associated to the damages caused by such cyber-attacks [16]. Existing protective and mitigating measures are not sufficient to cope with the sophistication of current attacks. This brings the need to enforce efficient preventive and mitigating measures that are attacker-oriented, i.e., countermeasures that are specific to the attacker or group of attackers performing the attack. Furthermore, discovering who performed an attack and bringing the perpetrators to justice, can act as a deterrent for future cyber-attacks.

Attacker-oriented countermeasures require to discover the perpetrator of the attack or the entity related to it. Attribution is the process of assigning an action of a cyber-attack to a particular entity/attacker/group of attackers. Currently, the attribution of cyber-attacks is mainly a manual process, performed by the forensic analyst, and is strictly related to the knowledge of the analyst, thus, is easily human biased and error-prone. Attributing cyber-attacks is not trivial, as attackers often use deceptive and anti-forensics techniques [18], and the analysts need to analyze an enormous amount of data, filter [23, 38] and classify them. The increasing use of IoT devices aggravates the work of the analysts and makes the attribution process more expensive, as the analysts might need to physically access the devices to retrieve their data.

Digital forensics helps during the attribution process, as it collects and analyzes the evidence left by the attack, but it is not able to deal with conflicting or incomplete information. It only works with technical evidence, and fails to consider other aspects such as geopolitical situations and social-cultural contexts that provide useful leads during an investigation. Digital forensics tools mainly focus on collecting the evidence, which is then given to the analyst for analysis. This makes the process often extremely human-intensive, requiring many skilled analysts to work for weeks or even months [31, 45]. The problem is aggravated by the large proportion of unstructured data, which makes the automated analysis challenging.

In this work, we propose an automatic reasoner (ABR), based on argumentation and abductive reasoning that helps the forensic analyst during the evidence analysis and attribution process. Given the pieces of cyber forensic and social evidence of a cyber-attack, the proposed reasoner analyzes them and derives new information that is provided to the analyst. In particular, ABR can answer queries, such as, who is a possible perpetrator of an attack, who has the motives to perform it, what are the capabilities needed to perform an attack or what are the similarities with past attacks. Furthermore, ABR can suggest to the analyst other paths of investigation, by giving hints on what other pieces of evidence can be collected to arrive at a conclusion thus, enabling a prioritized evidence collection. Our reasoner is based on our preliminary work [25, 24] where we briefly presented the main intuition behind ABR. To the best of our knowledge, this is the first automatic reasoner that helps with the analysis of cyber-attacks using both technical and social evidence, and that is able to reason with conflicting and incomplete knowledge.

The reasoner uses a set of reasoning rules, preferences between them, and background knowledge. The rules of the reasoner are constructed from the input provided by the expert user and from the analyses of past attacks. To illustrate ABR, we have used in this paper rules extrapolated from the analysis of well-known cyber-attacks as published in the public literature (e.g., APT1 [27], Wannacry [32]). In particular, the rules were generalised so that they can be applied across different attack scenarios. The background knowledge incorporates typical common knowledge that analysts may use during the analysis process. In this work, we have used some of the knowledge extracted from the examples, as well as other public reports such as [19, 7, 8]. Our reasoner can assist in the attribution of an attack by using both technical evidence and social considerations that are represented thanks to the use of a social model [39].

ABR is able to work with incomplete and conflicting evidence. We decided to base ABR on an argumentation framework, in particular, a preference-based argumentation framework [22], which permits to reason with conflicting pieces of evidence by introducing preferences between the applied rules. We use preference-based argumentation as it is similar to the decision-making process followed by digital forensics investigators. ABR is constructed using the Gorgias [20] tool, which uses abductive reasoning [21] combined with preference-based argumentation. The use of abduction allows us to reach conclusions even with incomplete information, as the missing information is abduced (hypothesized) and then suggested to the analyst as hints of possible further evidence to be collected.

ABR is a proof-of-concept tool that aims to assist the analyst during the analysis process. Therefore, together with the answer to a query it also provides the explanation of the reasoning process, applied rules and the information used to reach that conclusion. Furthermore, ABR gives hints to the analyst for missing evidence, that, if provided, allows to pursue other investigation paths. ABR is flexible and adaptable to user requests and changes. The use of ABR helps to promote best practices and to share lessons learned from past experience as rules and background knowledge can be constructed with expert input and then shared and re-used across investigations.

In Section 2 we present the relevant related work. We introduce our argumentation-based reasoner (ABR) in Section 3. In Section 4 and 5 we present ABR’s main components, correspondingly its reasoning rules and its background knowledge. We give an overall evaluation and discussion in Section 6. In Section 7 we conclude and present some interesting future research directions.

2 Related Work

Attribution of a cyber-attack is the process of “determining the identity or location of an attacker or attackers intermediary” [46]. Tracing the origin of a cyber-attack is difficult as attackers can easily forge or obscure information sources, and use anti-forensics tools, to avoid being detected and identified [18]. Digital forensics plays a significant role in attribution by collecting, examining, analyzing and reporting the evidence [26]. Other techniques created for protecting the systems are also used to collect forensic data, e.g., traceback techniques [46], honeypots [4], or other deception techniques [1, 2, 44].

Digital forensics comes with its own challenges [6], that can mainly be categorised into: complexity problems as the collected data are in the lowest raw format and require high resources to analyze them and quantity problems as the enormous amount of collected data is too large to be analyzed manually [9]. Forensics techniques identify and collect the evidence that is later managed and analyzed by the forensic analyst. Since often the data are collected from different sources and the attackers can plant false evidence to lead the investigator off his/her trail, the latter is likely to be in a situation with multiple pieces of conflicting evidence. Digital forensics techniques can deal with conflicting information during the evidence collection phase [5, 15], but lack the ability to work with conflicting pieces of evidence during the analysis and attribution process. These techniques can collect pieces of evidence [42], but have difficulties reasoning with incomplete information, and reaching conclusions without having all the needed pieces of evidence. Digital forensics only uses technical evidence [45] and fails to consider other factors such as geopolitical situations and social-cultural contexts, which could provide useful leads during the investigations.

A theoretical social science model is proposed in [39], called the Q-Model that describes how the analysts combine technical and social evidence during the attribution process. In this model, attribution is described as an incremental process passing from one level of attribution to the other. The Q-Model represents how the forensic investigators perform the attribution process and particular attention is placed on the social evidence, where contextual knowledge such as ongoing conflicts between countries or rivalry between corporations are very useful in detecting motives of potential culprits.

We decided to use argumentation for our reasoner, as argumentation helps during the analysis and attribution process because it is transparent and encourages the evaluation of the arguments, by assessing the relative importance of various factors when making decisions [35]. Argumentation captures the fact that the final decision might change if more information is available (i.e., non-monotonic reasoning [12]), where more information may reveal new arguments that are in conflict with the original ones and are stronger than them. Non-monotonic reasoning has previously been proposed to tackle the attribution challenge. For example, in [34, 43] the authors propose the DeLP3E framework to attribute operations of cyber-attacks. This theoretical framework is based on the extension of Defeasible Logic Programming with probabilistic uncertainty. The DeLP3E framework does not deal with incomplete evidence, and thus, cannot make assumptions to reach a conclusion and cannot suggest new paths of investigation or new evidence to be collected. It also lacks in general technical and social common knowledge, e.g., ongoing conflicts/rivalries between countries/corporations, information about past attacks, cyber-security capabilities of entities, which can be very useful in detecting motives, capabilities and potential culprits. DeLP3E uses as a measure for its conclusion the probabilities of an event being true. However, this requires the user to provide the probability of being true for each of the given pieces of evidence. It also does not distinguish the different levels of reasoning that can be applied to reach certain conclusions.

Despite the advances in using digital forensics or defeasible reasoning in attribution, some shortcomings still remain to be addressed. The most important one is that none of the current works considers the social aspects of attribution. The current state of the art does not deal with incomplete evidence, which is an important aspect of forensic investigations, as usually not all evidence can be collected due to time/resource constraints, and anti-forensics tools used by attackers can hide some of the evidence. We believe, our reasoner is the first attempt to use a social model to categorize evidence and rules in an argumentation-based framework, which leads to a more accurate and explainable attribution that helps the investigator during the analysis process also in case of conflicting and incomplete evidence.

3 Argumentation-Based Reasoner for Attribution

Let us now introduce our argumentation-based reasoner (ABR) that is based on a preference-based argumentation framework. ABR is composed of two main components the reasoning rules, and the background knowledge, see Figure 1. Given the evidence presented in input, ABR analyzes it and attempts to answer queries about the possible perpetrators of the attack, or provides suggestions for further pieces of evidence needed to reach a conclusion or perform a more precise or a different analysis. The reasoning rules used by ABR were extracted111Currently the extraction of the rules is done manually by analyzing various reports and articles about the analysis and attribution of past cyber-attacks. from public reports about past cyber-attacks and formalized in the argumentation framework222The rules extracted have not been evaluated for correctness and might not be complete i.e., they might not capture the complexity of the situations encountered.. In actual use, rules could be specified by expert users or extracted automatically from different analyses and then reviewed by expert analysts. Rules are divided into three layers: technical, operational and strategic layer, following the social model structure proposed in [39]. In this paper, we have used background knowledge based on the information extracted from online analyses of past cyber-attacks and relevant information for these attacks. ABR takes as input from the user the pieces of evidence (technical and social evidence) relevant to the current investigation and then analyzes them by using the reasoning rules and the background knowledge. It gives as result to the user answers to the user’s queries, e.g., if a given entity is a possible culprit of the attack, together with an explanation on how the conclusion was reached, hints about what other pieces of evidence the user can provide to perform a more precise or a new analysis.

3.1 Argumentation Framework for Attribution

We base our reasoner on a preference-based argumentation framework [22, 20], as it permits the user to take decisions while working with conflicting evidence, and it naturally encodes the different reasoning layers with its preference relations between rules. The used framework best simulates the analysis and attribution process made by an investigator, who needs to use different reasoning rules that work with technical and social aspects of the attack, have exceptions, and can derive conflicting conclusions.

Our framework allows the investigator to work with conflicting evidence and reasoning rules that derive conflicting conclusions, by introducing preferences between them. The introduced preferences can be considered as exceptions to other rules, or preferences that are context dependent. The use of argumentation permits to provide an explanation of the given results. Let us briefly introduce the used framework.

An argumentation theory is a pair $(\mathcal{T},\mathcal{P})$ of argument rules $\mathcal{T}$ and preference rules $\mathcal{P}$. The argument rules $\mathcal{T}$ are a set of labeled formulas of the form:

[TABLE]

where $L,L_{1},\ldots,L_{n}$ are positive or negative ground literals, and $rule_{i}$ is the label denoting the rule name. In the above argument rule, $L$ denotes the conclusion of the argument rule and $L_{1},\ldots,L_{n}$ denote its premises. The premise of an argument rule is the set of conditions required for the conclusion to be true. In our framework, the argument rules are the reasoning rules used by ABR. Let us show below a reasoning rule that is part of ABR:

[TABLE]

where the rule name is the label of the rule, in this case $str_{1}$; the head is the second argument and represents the conclusion of the rule, in this case $isCulprit(C,Att)$; the body predicates are the literals following the head, and represent the premises of the rule, in this case $ClaimResp(C,Att)$.

The preference rules $\mathcal{P}$ are a set of labelled formulas of the form:

[TABLE]

where $p_{i}$ is the label denoting the rule name, the head of the rule is $rule_{1}>rule_{2}$, and $rule_{1}$, $rule_{2}$ are labels of rules defined in $\mathcal{T}$, and $>$ refers to an irreflexive, transitive and antisymmetric higher priority relation between rules. The above rule means that $rule_{1}$ has higher priority than $rule_{2}$, or better $rule_{1}$ is preferred over $rule_{2}$. The preference rules, also called priority rules are true always or in certain conditions or contexts. We show below a priority rule, $p_{1}$, denoting that rule $str_{2}$ is preferred over rule $str_{1}$.

[TABLE]

We have priority rules between rules that are in conflict with each other or better that derive conflicting conclusions. Preference-based argumentation allows the investigator to handle non-monotonic reasoning [12] in attribution, where the introduction of new evidence might change the result of the attribution (due to conflicting arguments) and the investigator’s confidence in the results. Argumentation is particularly useful as it permits to represent the reasoning rules in an intuitive and simple way.

Let us introduce the following rule that is part of ABR:

[TABLE]

Rule $str_{2}$ describes that entity $X$ is not the possible culprit for the attack $Att$, because it does not have the capabilities for performing it. Rule $str_{1}$ and $str_{2}$ are in conflict with each other because when both preconditions are met, they derive conflicting conclusions. Given the above preference rule $p_{1}$, rule $str_{2}$ is preferred over rule $str_{1}$. Thus, in case both preconditions for $str_{1}$ and $str_{2}$ are given, we take into consideration only the conclusion from $str_{2}$ , $\neg isCulprit(C,Att)$.

The inputs of ABR are pieces of evidence that are used together with the background knowledge by the reasoning rules to derive new information. The reasoning rules and the preferences used in this paper were extracted from real cyber-attacks analyses and attribution taken from online public reports, such as [27, 32].

ABR is the first tool that is able to work with incomplete evidence. It provides hints of missing evidence or new investigation paths to the user, thanks to the use of abductive reasoning [21]. The use of abducible predicates permits to fill the knowledge gaps in the reasoning, by allowing ABR to perform the analysis and to reach a conclusion even when there are insufficient pieces of evidence. This feature is extremely important to the investigator who is provided with new possible conclusions and new evidence to be collected. To construct ABR we use the Gorgias [20] tool, which is a preference-based argumentation reasoning tool that uses abduction.

Let us now introduce the following rule from ABR:

[TABLE]

which states that $X$ has the motives to perform attack $Att$, when it has economical motives against the target $T$ of $Att$, where $T$ is an industrial company, the context of $Att$ was economical ($econ$), and $Att$ had a specific target. ABR treats $specificTarget$ as an abducible predicate. For every abducible predicate we have the rules that derive the predicate or its negation. For the $specificTarget$ abducible we can prove that it is not true by using the following rule.

[TABLE]

In case, we are not able to derive $\neg specificTarget(Att)$, then we can abduce (hypothesize) that $specificTarget(Att)$ is true, and we can use this result to derive $hasMotive(X,Att)$, in case we have the rest of the preconditions.

3.2 Technical and Social Attribution

The main goal of the ABR reasoner is to assist the forensic analyst during the evidence analysis. Given the pieces of evidence of an attack, the reasoner analyzes the evidence and derives new information, if possible attributes this attack to one or different possible entities, or provides suggestions on other pieces of evidence that the user can provide to better analyze and attribute the attack. To perform the attribution process, ABR also needs to work with non-technical evidence, usually called social evidence. To deal with these aspects, we have used a social model for attribution, called the Q-Model [39]. This model represents how the investigators perform the attribution process of cyber-attacks. Following the Q-Model, we categorize the evidence and the reasoning rules into three layers: technical, operational and strategic. The combination of information in these layers permits the attribution of a cyber-attack, as it aims to emulate the investigator’s attribution process. Depending on the layer a rule/evidence is part of, we call it a technical, operational, or strategic rule/evidence and denote its name starting correspondingly with $t$, $op$, or $str$.

The technical layer is composed of rules that deal with pieces of evidence obtained from digital forensics processes, related to technical evidence of the attack, and how it was carried out, e.g., the IP address from which the attack was originated, time of the attack, logs, type of attack, code used. Let us give below an example of a technical layer reasoning rule that is part of ABR:

[TABLE]

Rule $t_{1}$ denotes that if the attack $Att$ uses zero-day vulnerabilities, $usesZeroDay(Att)$, then this attack requires a lot of resources, $reqHighRes(Att)$.

The operational layer is composed of rules that deal with non-technical pieces of evidence that relate to the social aspects where the attack took place, e.g., the motives of the attack, the needed capabilities to perform it, the political or economical context where it took place. Let us give below an operational layer reasoning rule that is part of ABR:

[TABLE]

Rule $op_{3}$ denotes that if $Att$ requires a large amount of resources, and an entity $X$ has (large amounts of) resources, $hasResources(X)$, then $X$ has the capability to carry out the attack, $hasCap(X,Att)$.

The strategic layer is composed of rules that deal with who performed the attack, or who is obtaining advantage from it. Let us give below a strategic layer reasoning rule that is part of ABR:

[TABLE]

Rule $str_{3}$ denotes that if $X$ has both the capability, $hasCap(X,Att)$, and the motive, $hasMotive(X,Att)$, to carry out the attack $Att$, then $X$ is a possible culprit of the attack, $isCulprit(X,Att)$.

As shown in Figure 1, the operational rules use information derived from the technical layer, and the strategic rules use information derived from the technical and operational layers. All three layers use the evidence given by the user and the background knowledge. This categorization of the evidence and rules in three layers, following from the Q-Model, aims to emulate the forensic investigator’s analysis during the attribution process, where s/he moves from the technical layer, to the operational, and finally to the strategic one, by using the conclusions from the previous layers. Furthermore, this categorization improves ABR’s usability, given the investigator’s familiarity with these three layers.

4 ABR’s Reasoning Rules

To illustrate the use of ABR we have extracted around 200 reasoning rules from the analyses of different cyber-attacks reported in the public literature (e.g., APT1 [27] and Wannacry [32]). These rules have then been translated into generic argumentation rules to be used within the framework. These reasoning rules are considered as one of the main components of ABR as they permit to perform the reasoning behind the analysis and attribution of cyber-attacks. We briefly present some of these rules in this section.

As described in the previous section, the reasoning rules, also called simply rules, are divided into three layers: technical, operational and strategic. Let us give an overview of some of the strategic rules of the reasoner and show how the rules of the different layers are related to each other. The following rules describe some of the circumstances in which we can derive that an entity $X$ is a possible culprit ($isCulprit(X,Att)$) or not ($\neg isCulprit(X,Att)$) of an attack $Att$.

[TABLE]

Let us use the strategic rule $str_{3}$, to show the relations of the reasoning rules between the different layers. Rule $str_{3}$ uses the predicates $hasMotive(X,Att)$ and $hasCap(X,Att)$; where the first is a derived predicate of the operational layer, indicating that $X$ has motives to perform the attack $Att$ and $hasCap(X,Att)$ is a derived predicate of the technical and operational layer, indicating that entity $X$ has the capabilities to perform $Att$.

The $hasMotive$ predicate can be derived using the rule introduced in Section 3.1, represented as below:

[TABLE]

The above rule says that an entity $X$ has the motives to perform $Att$, when $X$ has economical motives to attack a particular entity $T$, which is an industry, and the attack was designed to target entity $T$, and the context of $Att$ was economical. The predicates used in $op_{1}$ are: $target(T,Att)$ is an evidence, stating that $T$ is the target of $Att$; $industry(T)$ is a background fact, stating that $T$ is an industry; $hasEconMot(X,T)$ is an evidence, stating that entity $X$ benefits economically from attacking industry $T$, (for example, if $countryC$ has identified $industryY$ as a strategic industry, we say that $hasEconMot(countryC,industryY)$ is true); $specificTarget(Att)$ is an evidence that is true when $Att$ was constructed to attack a particular target; $contextOfAtt(Y,Att)$ is an evidence stating that: if the target of an attack was a “normal”333“Normal” industries are companies that are not closely related to a country’s national interests. A “political” industry is a company that is closely related to a country’s national interests, e.g., the defence or energy sector. industry, then the context was economical ($econ$), if the target was a “political” industry, then the context was political ($pol$).

We introduce below one of the rules that derives the $hasCap$ predicate444Numerous factors can be used to determine the capability. However, for the sake of space, we introduce only one of the possible rules that can derive the capability ($hasCap$) predicate..

[TABLE]

Rule $op_{3}$ states that $X$ has the capability to perform $Att$, when $Att$ requires high resources and $X$ has the needed resources. Predicate $reqHighRes(Att)$ can be derived from the following technical rules:

[TABLE]

where $highSecurity(T)$ means that entity $T$ has high security measures in place; $highVolAtt(Att)$ means that $Att$ has a high volume; $longDurAtt(Att)$ means that $Att$ was performed over a long duration (few months or even years), and $highLevelSkill$ means that $Att$ is a complex attack and requires high level skills to be performed. Rule $t_{2}$ states that $Att$ requires high resources if its target has put in place high security measures, rule $t_{3}$ states that $Att$ requires high resources if the attack has a high volume and a long duration, and rule $t_{4}$ states that $Att$ requires high resources if it requires advanced skills.

ABR’s rules are used to analyze the evidence and to derive new conclusions, in order to offer new insights to the analyst, as shown in the example below.

Example 1

Let us consider the example of the US bank hack [17], that occurred in 2012. During this attack, US banks faced denial of service (DoS) attacks, causing websites of many banks to suffer slowdowns and even be unreachable for many customers. The banks’ web hosting services were infected by a sophisticated malware called Itsoknoproblembro, (denoted as $itsOKnp$). Earlier that year, US government placed economic sanctions against Iran. Some of the pieces of evidence provided to ABR for this attack ($usBHack$) are as below:

[TABLE]

By using rule $t_{4}$ and the evidence that this attack required a high level of skill, ABR derives that this attack requires high resources, $reqHighRes(usBHack)$.

Another rule capturing that an entity might have a political motive if it has been the target of sanctions can be written as follows:

[TABLE]

Rule $op_{4}$ would then derive555ABR’s derived evidence is derived from the application of the rules to the input evidence and thus depends on both rules and evidence being correct. that Iran might have political motives against US because of the sanctions imposed by US against Iran [17], $hasPolMotive(iran,us,[2012,2])$. $\Box$

5 ABR’s Background Knowledge

ABR uses background knowledge comprising non-case-specific information and divided into general knowledge and domain-specific knowledge. Some of the background knowledge predicates used in this paper are shown in Table 1. The use of the background knowledge alleviates the analysts’ work and helps avoid human errors and bias. It comprises of pieces of information that are used as preconditions by the reasoning rules to answer the users’ queries. ABR’s background knowledge can be updated and enriched by the user. Note that reaching meaningful conclusions through the application of the rules to the background knowledge relies on the correctness of the background knowledge given.

5.1 General Knowledge

The general knowledge consists of information about countries characteristics, international relations between nations, and classification of the types of industry. This information is used together with the given pieces of evidence, to perform the analysis. Below we illustrate how these predicates are used by ABR’s rules.

Language indicators in malware can provide useful clues regarding the possible origin of attacks. We use two language artifacts: default system language settings, $sysLang$, and language used in code, $langInCode$. We present below two rules of ABR, $t_{5}$ and $t_{6}$, that use the language evidence to derive the possible origin of the attack $attackPOrig$, when the country’s first language $firstLang$ matches the one found in the system/code.

[TABLE]

The cyber capability of a nation is another interesting information as it limits the type of attacks that an entity can carry out. We have used the Global Cybersecurity Index (GCI) Group [19] and the cyber capabilities of countries in cyberwar [7] as sources for this information. There are three GCI groups: leading, maturing and initiating, from where we classify the countries according to their capabilities. Furthermore, based on the cyber capabilities in cyberwar [7] we identify some countries as cyber “superpower”. We show below three of ABR’s rules that use the countries’ cyber capability.

[TABLE]

A country $hasResources$ if it is in the ‘leading’ GCI group or is a cyber “superpower”. Countries in the ‘initiating’ GCI group are considered as $hasNoResources$.

Example 2

Let us continue with the $usBHack$ introduced in Example 1. In the background knowledge, we have that Iran is a cyber “superpower”666Iran is mentioned as a “notable player” in [7]. Thus, we identify it as a cyber “superpower”.. Thus, using rule $t_{8}$ ABR derives that Iran has the resources to carry out sophisticated attacks, $hasResources(iran)$. Similarly the application of the operational rule $op_{3}$ derives that Iran has the capabilities777Note that we have a list of countries that have the resources to perform the attack, given their cyber capabilities. Rule $op_{3}$ is applied to all these countries. For the sake of simplicity, we only show the entities that are of interest to the discussed example. to perform the US bank hack, as shown below.

[TABLE]

$\Box$

Good international relations between two countries can indicate that a state-sponsored attack is unlikely. We encoded this information in ABR by creating a list of countries that have good relations with each other ($goodRelation$) and a list of countries that may have poor relations with each other ($poorRelation$) according to  [47, 8]. This information can then be used to narrow down the countries that might have or not a motive to carry out an attack, as shown by the following rule.

[TABLE]

Rule $op_{5}$ derives that country $C$ does not have any motive to perform $Att$, as it has good relations with $T$ that is the country that $Att$ has as target, ($targetC(T,Att)$).

5.2 Domain-Specific Knowledge

Domain-specific knowledge consists of information about prominent groups of attackers and past attacks. These facts are primarily used in the strategic and technical layers. We encoded information on prominent APT groups taken from [14, 29], where for each group we have their: name or ID; country of origin; countries/organisations targeted by the group in the past; malware or pieces of malicious software (suspected or confirmed) linked to the group, as well as relations of this group with other entities (e.g., governments). We assume these groups have the capabilities of conducting long term and significant attacks. Thus, we derive that an entity $X$ has the capabilities to perform an attack, if $X$ is a prominent group of attackers, as shown by the rule below $op_{6}$.

[TABLE]

Another important part of the domain-specific knowledge is the similarity with past attacks. For example, similarity to an APT-linked malware may indicate that the same APT group may be responsible. This is presented in rule $str_{4}$.

[TABLE]

In rule $str_{4}$, we derive that the attacker of $Att$ is most likely entity $X$, because the malware used is similar to another malware linked to $X$, and both malware codes were not found on the black market ($notBlackMarket$)888Currently, ABR is not able to derive the evidence $notBlackMarket$. This evidence is either provided by the user or given in the background knowledge.. We use the predicate $similar(M1,M2)$ to denote that two malwares are similar to each other. In the rules below we define that $M1$ and $M2$ are similar if they use a similar code obfuscation ($similarCodeObf$) mechanism, or they share code, or $M1$ is derived by modifying $M2$, or they have similar command and communication (C&C) servers999For the sake of simplicity, in this paper we introduce only a subset of ABR’s rules that identify similarities between malwares or malicious software., where the similarity of C&C servers of two different malwares can be derived by using other ABR’s technical rules.

[TABLE]

6 Evaluation and Discussion

ABR aims to be a flexible tool designed to be part of an iterative process, where the user can add other pieces of evidence, rules or preferences after evaluating the answers produced by the tool. ABR’s input is given manually by the analyst, or could be collected, in part, automatically through an automatic extraction process by using digital forensics tools.

6.1 Evaluation

We have tested ABR’s performance and usability using examples of cyber-attacks published in the online literature. During the evaluation, ABR used the reasoning rules correctly to identify possible attackers. The explanations provided, in the textual and the graphical representations, helped to improve the usage of ABR as they provided information that was used by the user for the next iterations. ABR answered the queries requested (e.g., if a country had the motives or capabilities to perform the attack, or if a particular group of attackers could be related to the attack following the technical evidence of the used malware) as expected, given the pieces of evidence provided as input. Note that ABR assumes that the input evidence is correct, and providing inaccurate or incomplete information may lead to incorrect conclusions.

For every tested example, we ran ABR using a subset of the input evidence. Depending on the use-case and the provided evidence, ABR was able to reach some conclusions by abducing (hypothesizing) some of the missing predicates. ABR gave interesting results when asked to provide suggestions for missing evidence, as it proposed useful missing evidence and also new (not predicted) investigation paths. When a significant part of the evidence was provided to ABR, its results coincided with those in the publicly available analyses or the entity attributed in the publicly available analyses was contained in ABR’s list of possible culprits, which also contained other possibilities.

Let us now briefly introduce some of the cyber-attacks used to evaluate ABR and its conclusions. For the sake of space, we decided to show some well-known attacks where ABR was tested, as they do not need a detailed introduction.

ABR analyzed evidence of the Stuxnet attack [48, 30] and derived two different entities as possible culprits: US and Israel. The Stuxnet attack was first discovered in 2010 at the uranium enrichment plant in Iran. The code used was complex, using four zero-day vulnerabilities and mainly targeted Iran. ABR explained the conclusion based on the high resources required to perform such a sophisticated attack, and the political conflicts that existed in that period between Iran and US, and between Iran and Israel. In this case, the social evidence provided to ABR mainly included the political conflicts between Iran and these two countries. However, ABR would have listed as possible source of the attacks any entity for which it could derive a motive and that had the resources to perform such sophisticated attacks.

ABR analyzed evidence of the Sony Pictures attack [40]. The Sony Pictures attack represents the 2014 attack when hackers infiltrated Sony’s computers and stole data from Sony’s servers. A group called “Guardians of Peace” claimed credit for the attack, but several US government organisations claimed that the attack was state-sponsored by North Korea  [10, 11, 40]. ABR attributed this attack to three possible culprits: the attackers group called “Guardians of Peace” and to two countries, Iran and North Korea. The attribution to Iran came as a consequence of low diplomatic relations between US and Iran. ABR’s results were unexpected, with respect to the attribution given in [10, 11, 40]. In this case we see that ABR can suggest new possible paths of investigation.

ABR analyzed evidence from the Conficker [41] attack and, using the evidence provided, was not able to reach a result. Some of ABR’s suggestions were to find entities that operated/worked in Ukraine or that had interest in Ukraine, as the first version of the attack was constructed to avoid machines with Ukrainian keyboards [37], thus to avoid a specific country (Ukraine). ABR suggested also to find evidence about political or economical motivations for the attack, as the attack was sophisticated and it could either be a nation-state attack or performed by a cyber-criminal organization.

Example 3

Let us now show ABR’s final steps of the analysis and attribution of the $usBHack$. Following from Example 1 and 2, ABR derived the following predicates: $hasCap$ $(iran,usBHack)$ and $hasPolMotive(iran,us,[2012,2])$. ABR can now apply the following operational rule:

[TABLE]

Rule $op_{7}$ permits ABR to derive that Iran has motives to perform the attack, as it has political motives. Furthermore, these motives are applicable for the attack, as they occurred less than 1 year before the attack took place. By applying rule $str_{3}$, ABR derives that Iran is a possible culprit for this attack ($isCulprit(iran,usBHack)$). This result is in line with the attribution reported in [28], while it does not match another attribution reported in [36], which attributed the attack to a group of hackers. ABR provides its conclusion to the analyst together with its derivation tree with all the rules and evidence used.

ABR provides further results of possible culprits, when new information is provided. For example, when new evidence is provided that a leader of the al-Qassam Cyber Fighters hackers group has publicly claimed this attack [36], then ABR derives that this group is also one of the possible attackers.

$\Box$

6.2 Discussion

Together with the answers to the queries, ABR also provides the different ways in which the result was derived. Furthermore, every result comes with its explanation that is composed of the rules and pieces of evidence used. The explanations are in the form of text and graphical representation. The given explanations make ABR’s result and analysis process transparent to the user and provides her/him further information that can be used for the analysis. ABR does not require the user to be familiar with the argumentation reasoning framework used as the user needs only to provide the evidence (in some cases the evidence is automatically extracted), and to launch the queries. The main goal of ABR is to help the investigator during the analysis process and provide useful information.

ABR’s results include hypothesized but missing evidence and suggestions about other investigations paths that could be followed by the analyst. The missing evidence suggested can be collected by the analyst in a second moment and given to ABR as part of an iterative process. We decided to provide only the first list of results of the “missing” pieces of evidence, together with the conclusions that could be derived from them, to keep ABR’s running time and complexity polynomial. Hence, ABR does not provide an exhaustive list of all the possible hypotheses/missing evidence. On the other hand, limiting the suggested evidence to be collected can be beneficial for the analyst, who can focus his/her attention on particular evidence, instead of spending time and resources on checking an exhaustive list.

ABR promotes best practice and helps to share lessons learned between analysts, as its reasoning rules can be constructed using the analysts’ reasoning process and be used by multiple investigators across different events. It also helps investigators cope with large numbers of rules and large knowledge bases. The attribution process is mainly human-based, and thus can be easily biased, e.g., by the resources invested [13]. In some cases, it may be difficult for the analyst to abandon a path of investigation when substantial resources have been devoted to it. ABR permits to reduce the human bias through the rigorous application of rules and by suggesting new paths of investigation.

ABR relies on the reasoning rules with which it has been provided. Thus, ABR can fail to deal with new evidence that has not been encountered before and which is not included in the reasoning rules. Furthermore, ABR relies on the rules being correct and complete. To illustrate its operation we have extracted 200 rules from public reports and analyses of cyber-attacks. However, the rules need to be validated with expert analysts and the rule base would need to be enriched with further rules for broader use. To facilitate the extraction and update of the reasoning rules and the background knowledge, we plan to investigate the automated extraction of rules and knowledge through the use of NLP techniques in conjunction with ontologies for cyber-attack investigations.

As ABR uses in its reasoning information from past attacks and past attributions, it will derive the wrong conclusions if the information is incorrect. In particular, if a past attribution was incorrect, the error can be propagated to ABR’s new results. For example, the Sony attack attribution [40] was built on the (alleged) claim that North Korea was responsible for the assault on South Korean banks in 2013 [3]. We can avoid this problem, by not using past attribution decisions as part of the knowledge, but it would make the attribution more difficult or cumbersome as it would require a larger amount of additional evidence. Furthermore, using results of past attributions is a common practice adopted by forensic analysts during their analysis and attribution process, as it permits to identify existing groups of attackers and to use their modus operandi as an important factor for the attribution.

7 Conclusion and Future Work

In this work, we proposed a method and proof-of-concept argumentation-based reasoner (ABR) that aims to help forensic investigators during the analysis and attribution process of cyber-attacks. Our aim was to demonstrate how such a tool can be constructed using the proposed argumentation framework. ABR aims to help attribute cyber-attacks by leveraging both social and technical evidence. It provides explanations of the given results and hints of new investigation paths. The use of preference-based argumentation and abductive reasoning permits ABR to work with conflicting pieces of evidence and to fill the knowledge gaps that derive from incomplete ones. We introduced ABR’s main components that are its reasoning rules (that are based on past analyses and expert knowledge), and its background knowledge. We improve ABR usability by applying the Q-Model and categorizing the evidence and rules in three layers, thus following a model familiar to the forensic analysts. Our reasoner emphasises the incremental and iterative nature of attribution, by making the derivations of the solutions fully transparent to the user.

In our future work, we plan to increase ABR’s reasoning capabilities by adding new reasoning rules, and new background knowledge. In this work, we mainly focused on constructing the ABR reasoner, addressing its usability and showing its possible use. We leave a careful and possibly semi-automated population of the reasoning rules and background knowledge for future work. In particular, we plan to use NLP techniques to automatically extract the reasoning rules and social evidence used by forensic analysts. Furthermore, we intend to enhance the expressive power of ABR’s reasoner using ontologies. We also aim to address its integration with forensic tools and data mining techiniques. We plan to apply ABR to other cyber-attacks, across a broad range of threats and to improve its usability using feedback from forensic analysts. Another interesting future work is to include probabilities for our pieces of evidence and reasoning rules, in order to provide probabilistic measures for the analysis and attribution results.

Acknowledgments

Erisa Karafili was supported by the European Union’s H2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No. 746667.