# Improving Forensic Triage Efficiency through Cyber Threat Intelligence
## 1 Introduction  
Cyber Threat Intelligence (CTI) focuses on the collection and analysis of information concerning current and potential attacks that threaten the security of an organization or its assets. It is a relatively new approach for securing information systems that aims to improve the inefficiencies of traditional defence mechanisms by contributing to the provision of managed security services. As such, CTI is an essential component that offers both proactive and reactive security (also known as incident response and forensics) to protect systems against a plethora of attacks, even against initially undetected compromises, while shortening the window between compromise and detection if protection mechanisms fail [1]. Despite the robustness of CTI security implementations, the proliferation and sophistication of new threats, such as malware and advanced persistent threats (APTs), challenges their effectiveness. For example, Symantec found that \"zero-day\" exploits are currently in circulation, most commonlyon the dark web, for 300 days on average before identification [2], while the mean time of malware instances being undetected on compromised systems is 101 days [3]. Mandiant's report [3] also indicates that four out of ten organisations do not detect such compromises themselves, which can increase incident discovery and response complexity. At the same time, the new era of data protection legislation, such as in the case of the European Union where the stricter law framework of the General Data Protection Directive (GDPR) has already been enforced, incident response and investigation time become even more critical as undetected compromises and the subsequent incident response may have an adverse financial effect on organisations. Moreover, the complexity, heterogeneity, correlation and sheer volume of data are some of the challenges digital forensics now face [4]. To this extent, the emergence of Digital Forensic Readiness (DFR) is considered a promising approach towards addressing several of these challenges. Driven by the need to further improve the effectiveness and applicability of DFR, this paper demonstrates that coupling DFR practices with CTI could successfully improve Key Performance Indicators (KPIs) related to the volume, correlation and complexity problems that traditional digital forensics approaches face. The contribution and focus of this paper are illustrated in Figure 1. Considering an investigation scope and all digital evidence (S), the evidence related to a given case would be subset E, whereas subset T represents the evidence collected during the triage phase. In an ideal scenario, the triage set will contain information only related to the case, filtering out all the \"noise\". However, in a real case scenario, following the execution of the triage process, the following outcomes are expected:  
* A subset of digital evidence items identified by triage (true positives or \"hits\")
* A subset of items not relevant to the case, but included in the triage subset (false positives)
* A subset of items relevant to the case, but not identified by the triage (false negatives or \"misses\"). Due to the nature and purpose of the triage, there is a bias and preference towards reducing false negatives (min\(|[E-T]|\)) at the expense of increasing the false positives. In other words, a forensic analyst would be in favour of influencing the triage criteria in order to include as much digital evidence as possible rather than risk missing them. In this paper, we argue that this trade-off can be improved by bringing correlation forward to the triage phase. Building on our proposed threat intelligence informed DFR model [5; 6], this paper evaluates its effectiveness by empirically evaluating it through scenarios based on real attack data. The results of  
Figure 1: Problem definition. the experiments are indicative of the contribution of an enhanced DFR model, and they indicate that it is capable of identifying and limiting the key causes of security incidents in an efficient period of time.