{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,25]],"date-time":"2026-08-25T15:48:55Z","timestamp":1787672935934,"version":"build-2736575974"},"reference-count":39,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/tifs.2021.3054966","type":"journal-article","created":{"date-parts":[[2021,1,28]],"date-time":"2021-01-28T20:43:12Z","timestamp":1611866592000},"page":"2397-2412","source":"Crossref","is-referenced-by-count":47,"title":["Data-Driven Decision Support for Optimizing Cyber Forensic Investigations"],"prefix":"10.1109","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1182-182X","authenticated-orcid":false,"given":"Antonia","family":"Nisioti","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3559-5182","authenticated-orcid":false,"given":"George","family":"Loukas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7400-2357","authenticated-orcid":false,"given":"Aron","family":"Laszka","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7306-4062","authenticated-orcid":false,"given":"Emmanouil","family":"Panaousis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101734"},{"key":"ref38","year":"2020","journal-title":"ATT&CK MITRE"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2018.00136"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS.2016.7473520"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2012.2223679"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2014.01.007"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.23919\/CNSM.2017.8256038"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41148-9_16"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS.2012.6412636"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2012.58"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.03.001"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2494502"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23141-4_9"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2854724"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"ref15","first-page":"1723","article-title":"Dependence-preserving data compaction for scalable forensic analysis","author":"hossain","year":"2018","journal-title":"Proc 27th USENIX Secur Symp (USENIX Secur )"},{"key":"ref16","first-page":"487","article-title":"SLEUTH: Real-time attack scenario reconstruction from COTS audit data","author":"hossain","year":"2017","journal-title":"Proc 26th USENIX Secur Symp (USENIX Secur )"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00064"},{"key":"ref18","first-page":"1","article-title":"Network forensics analysis with evidence graphs (demo proposal)","author":"wang","year":"2005","journal-title":"Proc Digit Forensic Res Workshop"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2005.14"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2010.5593235"},{"key":"ref4","author":"martin","year":"2014","journal-title":"Cyber Kill Chain"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2019.07.006"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2006.06.008"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-86"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2988602"},{"key":"ref5","article-title":"Kaspersky security bulletin 2019: Advanced threat predictions for 2020","author":"diaz","year":"2019"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.10.007"},{"key":"ref7","article-title":"Acpo good practice guide for digital evidence","author":"williams","year":"2012"},{"key":"ref2","year":"2019","journal-title":"2019 cost of a data breach report"},{"key":"ref9","first-page":"1","article-title":"Standardizing cyber threat intelligence information with the structured threat information expression (STIX)","volume":"11","author":"barnum","year":"2012","journal-title":"MITRE Corp"},{"key":"ref1","article-title":"Cyber security breaches survey 2019","author":"finnerty","year":"2019"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2017.05.001"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2019.01.007"},{"key":"ref21","year":"2012","journal-title":"Acpo Good Practice Guide for Digital Evidence for Digital Evidence"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2176117"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2005.04.002"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2015.04.004"},{"key":"ref25","author":"kolodner","year":"2014","journal-title":"Case-Based Reasoning"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/9151439\/09339971.pdf?arnumber=9339971","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,5,10]],"date-time":"2022-05-10T14:52:40Z","timestamp":1652194360000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9339971\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":39,"URL":"https:\/\/doi.org\/10.1109\/tifs.2021.3054966","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}