## 3 nIoVe Framework
#### CAVeCTIR Method  
As discussed, the attack attribution process and the appropriate assignment of an attack profile are crucial steps in post-incident forensic analysis. Some characteristics and features of the detected attack can be directly extracted from the analysis of the acquired data. Others require more intense and complex procedures of processing and knowledge extraction, which are based on interrelating different CTI reports. These CTI reports are recorded in a CTI repository based on the MISP sharing platform [26]. The CTI reports might share common characteristics (e.g., attack techniques, attack models, analysis methods), and thus, they might be potentially correlated with each other. However, this information is not visible to the cybersecurity stakeholders, and thus, we propose the CAVeCTIR method, which supports the automatic interrelation and matching of a detected malicious activity with a collection of stored CTI reports. CAVeCTIR extends the CTIMatcher tool presented in our previous work [39], as it provides a more holistic solution that supports more and diverse types of malicious activities found in IoV. The CAVeCTIR aims to assist cybersecurity stakeholders (e.g., cybersecurity experts and analysts) in identifying CTI reports that describe similar malicious activities and thus boost post-incident forensic analysis. CAVeCTIR supports the following processes (Figures 1 and 2), which are technically implemented through micro-services in the IoV ecosystem. * _Initialization of attack profile_: CAVeCTIR extracts characteristics of the detected attack directly and initializes the attack profile. These characteristics include the IoV components (e.g., sensors) that have been attacked, propagation trends, risk assessment regarding the overall IoV system, and the level of confidence regarding the impact of the attack. Based on these, an initial attack profile is generated and assigned to a new forensic case. * _Acquisition of CTI reports_: In parallel with the previous step, CAVeCTIR seeks, processes, and acquires CTI reports from various platforms and repositories, including both the internal MISP-based CTI repository and other external repositories to which the organization has access (e.g., shared threat intelligence repository). The output of this step is a collection of the acquired CTI reports. * _Features selection/extraction_: Based on the collected information related to the detected attack and the CTI reports, CAVeCTIR aims to reduce the number of features and rank the importance of these features through feature selection and extraction processes. It generates a features model fed to the matching analysis process, aiming to provide an efficient and quick machine-learning clustering approach. * _Algorithm selection_: Several algorithms are supported for both supervised and unsupervised machine learning. Focusing on the unsupervised techniques, the supported algorithms include k-means clustering, mean-shift clustering, density-based spatial clustering of applications with noise (DBSCAN), affinity propagation, hierarchical clustering, balanced iterative reducing and clustering using hierarchies (BIRCH), and ordering points to identify the clustering structure (OPTICS). The selection of the most effective algorithm depends on various factors, including the selected features, the knowledge of the number of clustering, and the sample size. * _Matching analysis_: Having as input the profile of the detected attack, the acquired CTI reports, the features model, and the appropriate machine-learning algorithm, CAVeCTIR proceeds with the matching analysis, which aims to cluster the CTI reports dynamically and in real-time. Similarities and differences between the CTI reports are recorded. In the end, the detected attack is matched with one or more CTI reports, which are characterized as interrelated, meaning that they describe malicious activities, tools, techniques, and processes that share common patterns with the newly detected attack.