Context-Based Heuristics in Attribution

In cyber forensics, attribution of an attack, which finds out details about the individual(s) who launched an attack, is more important than mere identification of an attack, since a precise response to the cyber attack heavily depends upon attribution. The identification of the initiator(s) in attribution provides precise targeting for a counter-attack. However, heuristics are typically deployed to find out information about attack actions rather than initiator(s) of attack actions. This paper proposes a mechanism that utilizes a weight system for guiding the way in which the heuristics prioritize the discovery of attacker initiator(s). Linking purpose, methods, time, location, and events with the identified device, the proposed heuristic approach can serve as a path towards accurate and prompt attribution.