A cybercrime incident architecture with adaptive response policy. Issue 83 (June 2019)

• Record Type: Journal Article
• Authors: Tsakalidis, George; Vergidis, Kostas; Petridou, Sophia; Vlachopoulou, Maro
• Is Part Of: Computers & security. Issue 83(2019)
• Page Start: 22
• Page End: 37
• Publication Date: 2019-06
• Subjects: Cybercrime incident -- Offence classification system -- Cyber-security -- Threat severity -- Security and privacy -- Investigation techniques -- Social engineering attacks -- Malware/spyware crime; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.01.011
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Handling and mitigating the cybercrime incidents (CIs) have attracted significant research attention, over the last years, due to their increasing frequency of occurrence. However, the term cybercrime is often used interchangeably with other technology-linked malicious acts, such as cyberwarfare, and cyberterrorism, leading to misconceptions. In addition, there does not exist a management framework which would classify CIs, qualitatively and quantitatively evaluate their occurrence and promptly align them with appropriate measures and policies. This work introduces a Cybercrime Incident Architecture that enables a comprehensive cybercrime embodiment through feature identification, offence classification mechanisms, threats' severity labeling and a completely novel Adaptive Response Policy (ARP) that identifies and interconnects the relevant stakeholders with preventive measures and response actions. The proposed architecture consists of four separate complementary components that lead to a manually – and in the future automatically – generated ARP. The idea is to build a holistic framework toward automated cybercrime handling. A criminal case study is selected to validate the introduced framework and highlight its potentiality to evolve into a CI expert system.