Profiling cyber attackers using case-based reasoning
Stelios Kapetanakis, Avgoustinos Filippoupolitis, George Loukas, Tariq Saad Al Murayziq · Greenwich Academic Literature Archive (University of Greenwich) · 2014
Abstract. Computer security would arguably benefit from more information on the characteristics of the particular human attacker behind a security incident. Nevertheless, technical security mechanisms have always focused on the at-tack's characteristics rather than the attacker's. The latter is a challenging prob-lem, as relevant data cannot easily be found. We argue that the cyber traces left by a human attacker during an intrusion attempt can help towards building a profile of the particular person. To illustrate this concept, we have developed an approach using case-based reasoning that indirectly measures an attacker’s characteristics for given attack scenarios. Our results reveal that case-based rea-soning has the potential of being used to assist security and forensic investiga-tors in profiling human attackers.