# Improving Forensic Triage Efficiency through Cyber Threat Intelligence
## 6 Discussion  
A novel model leveraging CTI to improve the levels of operational DFR was presented in this paper. To achieve this, the model contained three independent modules, with two of them working proactively and the third used during a forensic triage process. The primary function of the model was the establishment of an inventory containing a limited subset of log records with a high-precision list of cyber-threats, with the aim to minimize the time and consequently the cost of potential digital forensic investigations.  
The applicability and effectiveness of the aforementioned model was evaluated through a series of 205 experiments that employed well-known published datasets. In particular, the results indicated that in most cases, the model managed to identify accurately the malware instances that infected the target systems.  
In terms of effectiveness and performance, the model managed to limit significantly the network data that may require further analysis by at least 70%. From a digital investigation perspective, this is considered substantial, as it can help digital forensic analysts to examine the contents of audit log files in considerably less time. For example, should we consider that an investigator has to identify critical information in a log file containing \(n\) entries, then the time complexity for searching this file is \(\mathcal{O}(n)\). Limiting the percentage of entries by \(\kappa\), where \(0\leq\kappa<1\) yields a time complexity of \((1-\kappa)*\mathcal{O}(n)\), signifies that analysis time decreases in proportion to unrelated data. Moreover, it is highlighted that the proactive analysis of the experiments lasted approximately 100 s on average, proving the speediness of the entire process and thus highlighting even more the benefits it can provide to post-mortem analysis.  
It should be noted that the above time was achieved due to the architecture of the proposed model, which pre-processed the information it received. Populating both LIDB and ALDB with trustworthy information is potentially time-consuming; however, such a process can run in the background at predefined intervals without interrupting systems' operations and, thus, cannot remarkably affect the overall efficiency of the proposed model.  
Last but not least, the authors considered the cost implications of deployment and forensic investigation. In particular, the cost of a forensic analysis project containing several activities can be calculated by Equation (4) [43], where \(n\) is the number of activities, \(t\) the time to complete the \(i\)th activity, \(v\) the volume of the \(i\)th activity and \(c\) the capacity cost of the \(i\)th activity. The cost of the capacity refers to the cost of the resources used to perform the activities, such as salaries of employees, equipment and technology costs, rental of office space and any other costs incurred [44].  
\[Total\ Activity\ Cost=\ \sum_{i}^{n}c_{i}\mathit{div}_{i} \tag{4}\]  
Given that the proposed approach did not significantly affect the capacity cost, as it did not require high-end technological resources for the average organisation, it became clear that the total activity cost was proportional to the time and volume of incident investigation, and thus decreased.  
In conclusion, the proposed CTI-informed DFR model presented and evaluated in this paper can significantly enhance the DFR state of organizations, as it managed to improve effectively the following KPIs:  
* Decrease the volume of information an analyst needs to examine
* Minimise the time of a forensic investigation
* Limit the cost of forensic analysis
* Determine the root cause of an incident in a timely manner and with high precision
* Identify relevant threats that may have affected the security posture of an organization.