Profiling cyber attacks using Case-based Reasoning

Computer security would arguably benefit from more information on the characteristics of the particular human attacker behind a security incident. Nevertheless, technical security mechanisms have always focused on the at-tack's characteristics rather than the attacker's. The latter is a challenging prob-lem, as relevant data cannot easily be found. We argue that the cyber traces left by a human attacker during an intrusion attempt can help towards building a profile of the particular person. To illustrate this concept, we have developed an approach using case-based reasoning that indirectly measures an attacker’s characteristics for given attack scenarios. Our results reveal that case-based rea-soning has the potential of being used to assist security and forensic investiga-tors in profiling human attackers.