Fronesis: Digital Forensics-Based Early Detection of Ongoing Cyber-Attacks

Traditional attack detection approaches utilize predefined databases of known signatures about already-seen tools and malicious activities observed in past cyber-attacks to detect future attacks. More sophisticated apply machine learning abnormal behavior. Nevertheless, a growing number successful attacks the increasing ingenuity attackers prove that these are insufficient. This paper introduces an approach for digital forensics-based early ongoing called Fronesis. The combines ontological reasoning with MITRE ATT&CK framework, Cyber Kill Chain model, artifacts acquired continuously from monitored computer system. Fronesis examines collected by applying rule-based on cyber-attack ontology identify traces adversarial techniques. identified techniques correlated tactics, which then mapped corresponding phases resulting cyber-attack. Finally, proposed is demonstrated through email phishing scenario.