DIGITAL FORENSICS BASED EARLY DETECTION OF ONGOING CYBER ATTACKS

Abstract

This work presents an enhanced digital forensics–driven framework for the early detection of ongoing cyberattacks by extending the limitations of conventional detection mechanisms. Traditional approaches, primarily based on signature matching and isolated log analysis, often fail to identify sophisticated or evolving threats and lack the capability to correlate multi-stage attack behaviors. To address these challenges, the proposed mechanism integrates digital forensic artifacts with structured rule-based reasoning to enable continuous monitoring and intelligent attack reconstruction. The system leverages the MITRE ATT&CK knowledge base and the Cyber Kill Chain (CKC) model to systematically map observed system activities into adversarial techniques, tactics, and attack phases. By analyzing diverse digital artifacts such as emails, files, processes, and system logs, the model identifies traces of malicious behavior and correlates them temporally and logically to reconstruct attack sequences in real time. Unlike traditional systems, the proposed approach emphasizes forensic readiness, ensuring that evidential data is preserved while simultaneously supporting early detection. Furthermore, the use of ontology-driven reasoning enhances consistency, scalability, and adaptability of the detection process. The framework demonstrates improved accuracy in identifying ongoing attacks at earlier stages, thereby reducing response time and potential damage. This makes the proposed system highly suitable for modern cybersecurity environments requiring proactive and intelligent threat detection.