{"id":"https://openalex.org/W4313479837","doi":"https://doi.org/10.1016/j.fsidi.2022.301480","title":"Forensics for multi-stage cyber incidents: Survey and future directions","display_name":"Forensics for multi-stage cyber incidents: Survey and future directions","publication_year":2022,"publication_date":"2022-12-30","ids":{"openalex":"https://openalex.org/W4313479837","doi":"https://doi.org/10.1016/j.fsidi.2022.301480"},"language":"en","primary_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.fsidi.2022.301480","pdf_url":null,"source":{"id":"https://openalex.org/S4210178067","display_name":"Forensic Science International Digital Investigation","issn_l":"2666-2817","issn":["2666-2817","2666-2825"],"is_oa":false,"is_in_doaj":false,"is_indexed_in_scopus":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true},"type":"article","type_crossref":"journal-article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.fsidi.2022.301480","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064908064","display_name":"Antonia Nisioti","orcid":"https://orcid.org/0000-0002-1182-182X"},"institutions":[{"id":"https://openalex.org/I55060895","display_name":"University of Greenwich","ror":"https://ror.org/00bmj0a71","country_code":"GB","type":"funder","lineage":["https://openalex.org/I55060895"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Antonia Nisioti","raw_affiliation_strings":["Internet of Things and Security Centre, University of Greenwich, UK"],"affiliations":[{"raw_affiliation_string":"Internet of Things and Security Centre, University of Greenwich, UK","institution_ids":["https://openalex.org/I55060895"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089908689","display_name":"George Loukas","orcid":"https://orcid.org/0000-0003-3559-5182"},"institutions":[{"id":"https://openalex.org/I55060895","display_name":"University of Greenwich","ror":"https://ror.org/00bmj0a71","country_code":"GB","type":"funder","lineage":["https://openalex.org/I55060895"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"George Loukas","raw_affiliation_strings":["Internet of Things and Security Centre, University of Greenwich, UK"],"affiliations":[{"raw_affiliation_string":"Internet of Things and Security Centre, University of Greenwich, UK","institution_ids":["https://openalex.org/I55060895"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019049253","display_name":"Alexios Mylonas","orcid":"https://orcid.org/0000-0001-8819-5831"},"institutions":[{"id":"https://openalex.org/I141584323","display_name":"University of Hertfordshire","ror":"https://ror.org/0267vjk41","country_code":"GB","type":"funder","lineage":["https://openalex.org/I141584323"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Alexios Mylonas","raw_affiliation_strings":["School of Physics, Engineering & Computer Science, University of Hertfordshire, UK"],"affiliations":[{"raw_affiliation_string":"School of Physics, Engineering & Computer Science, University of Hertfordshire, UK","institution_ids":["https://openalex.org/I141584323"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5090517118","display_name":"Emmanouil Panaousis","orcid":null},"institutions":[{"id":"https://openalex.org/I55060895","display_name":"University of Greenwich","ror":"https://ror.org/00bmj0a71","country_code":"GB","type":"funder","lineage":["https://openalex.org/I55060895"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Emmanouil Panaousis","raw_affiliation_strings":["Internet of Things and Security Centre, University of Greenwich, UK"],"affiliations":[{"raw_affiliation_string":"Internet of Things and Security Centre, University of Greenwich, UK","institution_ids":["https://openalex.org/I55060895"]}]}],"institution_assertions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5064908064"],"corresponding_institution_ids":["https://openalex.org/I55060895"],"apc_list":{"value":2950,"currency":"USD","value_usd":2950},"apc_paid":{"value":2950,"currency":"USD","value_usd":2950},"fwci":1.118,"has_fulltext":true,"fulltext_origin":"pdf","cited_by_count":3,"citation_normalized_percentile":{"value":0.537783,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":75,"max":79},"biblio":{"volume":"44","issue":null,"first_page":"301480","last_page":"301480"},"is_retracted":false,"is_paratext":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9999,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9999,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9939,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sophistication","display_name":"Sophistication","score":0.7960266},{"id":"https://openalex.org/keywords/computer-forensics","display_name":"Computer forensics","score":0.49212044},{"id":"https://openalex.org/keywords/cyber-crime","display_name":"Cyber crime","score":0.43388706}],"concepts":[{"id":"https://openalex.org/C168725872","wikidata":"https://www.wikidata.org/wiki/Q991663","display_name":"Sophistication","level":2,"score":0.7960266},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.71836853},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.6096844},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.589038},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.55619174},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.49212044},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.47998545},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4766541},{"id":"https://openalex.org/C2989129637","wikidata":"https://www.wikidata.org/wiki/Q29137","display_name":"Cyber crime","level":3,"score":0.43388706},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.14012441},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.09691417},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.fsidi.2022.301480","pdf_url":null,"source":{"id":"https://openalex.org/S4210178067","display_name":"Forensic Science International Digital Investigation","issn_l":"2666-2817","issn":["2666-2817","2666-2825"],"is_oa":false,"is_in_doaj":false,"is_indexed_in_scopus":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true},{"is_oa":true,"landing_page_url":"http://gala.gre.ac.uk/id/eprint/37963/13/37963_PANAOUSIS_Forensics_for_multi_stage_cyber_incidents_Survey_and_future_directions_%28OA%29_2022.pdf","pdf_url":"http://gala.gre.ac.uk/id/eprint/37963/13/37963_PANAOUSIS_Forensics_for_multi_stage_cyber_incidents_Survey_and_future_directions_%28OA%29_2022.pdf","source":{"id":"https://openalex.org/S4306401244","display_name":"Greenwich Academic Literature Archive (University of Greenwich)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_indexed_in_scopus":false,"is_core":false,"host_organization":"https://openalex.org/I55060895","host_organization_name":"University of Greenwich","host_organization_lineage":["https://openalex.org/I55060895"],"host_organization_lineage_names":["University of Greenwich"],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"acceptedVersion","is_accepted":true,"is_published":false},{"is_oa":true,"landing_page_url":"http://gala.gre.ac.uk/id/eprint/37963/7/37963_PANAOUSIS_Forensics_for_multi_stage_cyber_incidents_Survey_and_future_directions.pdf","pdf_url":"http://gala.gre.ac.uk/id/eprint/37963/7/37963_PANAOUSIS_Forensics_for_multi_stage_cyber_incidents_Survey_and_future_directions.pdf","source":{"id":"https://openalex.org/S4306401244","display_name":"Greenwich Academic Literature Archive (University of Greenwich)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_indexed_in_scopus":false,"is_core":false,"host_organization":"https://openalex.org/I55060895","host_organization_name":"University of Greenwich","host_organization_lineage":["https://openalex.org/I55060895"],"host_organization_lineage_names":["University of Greenwich"],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false}],"best_oa_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.fsidi.2022.301480","pdf_url":null,"source":{"id":"https://openalex.org/S4210178067","display_name":"Forensic Science International Digital Investigation","issn_l":"2666-2817","issn":["2666-2817","2666-2825"],"is_oa":false,"is_in_doaj":false,"is_indexed_in_scopus":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, justice, and strong institutions","score":0.76}],"grants":[],"datasets":[],"versions":[],"referenced_works_count":51,"referenced_works":["https://openalex.org/W1499669957","https://openalex.org/W1977236908","https://openalex.org/W1994686640","https://openalex.org/W2000577549","https://openalex.org/W2001436649","https://openalex.org/W2014113877","https://openalex.org/W2016828421","https://openalex.org/W2061278117","https://openalex.org/W2112138185","https://openalex.org/W2136135923","https://openalex.org/W2312913777","https://openalex.org/W2408793237","https://openalex.org/W2508545160","https://openalex.org/W2592627133","https://openalex.org/W2610458965","https://openalex.org/W2617416222","https://openalex.org/W2628759714","https://openalex.org/W2748696935","https://openalex.org/W2752929869","https://openalex.org/W2758080252","https://openalex.org/W2769542598","https://openalex.org/W2774510177","https://openalex.org/W2793451519","https://openalex.org/W2818789173","https://openalex.org/W2892303285","https://openalex.org/W2903765663","https://openalex.org/W2910711617","https://openalex.org/W2911386828","https://openalex.org/W2914452207","https://openalex.org/W2925159895","https://openalex.org/W2950266870","https://openalex.org/W2951270751","https://openalex.org/W2953684237","https://openalex.org/W2963492322","https://openalex.org/W2969162245","https://openalex.org/W299810643","https://openalex.org/W3012164334","https://openalex.org/W3016458033","https://openalex.org/W3024339044","https://openalex.org/W3030561071","https://openalex.org/W3037778573","https://openalex.org/W3083749701","https://openalex.org/W3124852128","https://openalex.org/W3157720608","https://openalex.org/W3175131308","https://openalex.org/W3183268685","https://openalex.org/W3193654456","https://openalex.org/W3215802769","https://openalex.org/W4232316227","https://openalex.org/W4255445824","https://openalex.org/W4315746341"],"related_works":["https://openalex.org/W93745046","https://openalex.org/W4242080468","https://openalex.org/W4226237108","https://openalex.org/W4205463820","https://openalex.org/W4205125206","https://openalex.org/W3161846523","https://openalex.org/W3002268218","https://openalex.org/W2894247182","https://openalex.org/W2883757844","https://openalex.org/W1982246970"],"abstract_inverted_index":{"The":[0,101],"increase":[1,175],"in":[2,35,53],"the":[3,18,92,99,117,130,138,142,162,188],"complexity":[4],"and":[5,27,37,57,60,90,151,171,177],"sophistication":[6],"of":[7,21,55,66,75,85,123,141,190],"multi-stage":[8,87],"cyber":[9,44,67,82,88,144,191],"attacks,":[10],"such":[11,109,160],"as":[12,110,161,167,169],"advanced":[13],"persistent":[14],"threats,":[15],"paired":[16],"with":[17,62],"large":[19],"volume":[20],"data":[22],"produced":[23],"by":[24],"modern":[25,86],"systems":[26,97],"networks,":[28],"have":[29],"made":[30],"forensic":[31,45,83,118],"investigations":[32,84],"more":[33,51],"demanding":[34],"knowledge":[36],"resources.":[38],"Thus,":[39],"it":[40],"is":[41],"essential":[42],"that":[43,78,136],"investigators":[46],"are":[47,104],"supported":[48],"to":[49,80,174],"operate":[50],"efficiently,":[52],"terms":[54],"resources":[56],"evidence":[58],"recovery,":[59],"cope":[61],"a":[63,72],"wide":[64],"range":[65],"incidents.":[68],"This":[69],"paper":[70],"presents":[71],"comprehensive":[73],"survey":[74],"49":[76],"works":[77,102],"aim":[79,140],"support":[81,96],"incidents":[89],"highlights":[91],"need":[93,163],"for":[94,164,183],"decision":[95],"on":[98,186],"field.":[100],"reviewed":[103],"compared":[105],"using":[106,133],"11":[107],"criteria,":[108],"their":[111],"evaluation":[112],"method,":[113],"how":[114],"they":[115,125],"optimise":[116],"process,":[119],"or":[120,147],"what":[121],"stage":[122],"investigation":[124,145],"study.":[126],"We":[127,149],"also":[128],"classify":[129],"surveyed":[131],"papers":[132],"8":[134],"categories":[135],"represent":[137],"overall":[139],"proposed":[143],"method":[146],"tool.":[148],"identify":[150],"discuss":[152],"open":[153],"issues,":[154],"arising":[155],"from":[156],"this":[157],"extensive":[158],"survey,":[159],"realistic":[165,170],"evaluation,":[166],"well":[168],"representative":[172],"modelling":[173],"applicability":[176],"performance.":[178],"Finally,":[179],"we":[180],"provide":[181],"directions":[182],"future":[184],"research":[185],"improving":[187],"state-of-the-art":[189],"forensics.":[192]},"abstract_inverted_index_v3":null,"cited_by_api_url":"https://api.openalex.org/works?filter=cites:W4313479837","counts_by_year":[{"year":2023,"cited_by_count":3}],"updated_date":"2025-03-22T12:24:15.234913","created_date":"2023-01-06"}