Scholarlink

This paper presents the architecture of an intelligent assistant designed to support decision-making during the investigation of cybersecurity incidents. The assistant includes components that enable potential integration with event sources, extraction of incident-related facts from collected images, and generation of recommendations for the investigator at each stage of the process. The use of the proposed assistant ensures that incident investigations are conducted in a technically, theoretically, and legally sound manner. A comparative analysis with existing solutions is provided based on several criteria, including scalability, adaptability to various incident scenarios, and usability. An experimental evaluation of the proposed architecture was conducted under conditions approximating real-world investigations. The results confirm the practical applicability of the developed assistant in digital forensics tasks and highlight directions for its further development.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Architecture of a Decision-Support Assistant for Cybersecurity Incident Investigation

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Gorda Maxim,
  • Andrey Chechulin

摘要

This paper presents the architecture of an intelligent assistant designed to support decision-making during the investigation of cybersecurity incidents. The assistant includes components that enable potential integration with event sources, extraction of incident-related facts from collected images, and generation of recommendations for the investigator at each stage of the process. The use of the proposed assistant ensures that incident investigations are conducted in a technically, theoretically, and legally sound manner. A comparative analysis with existing solutions is provided based on several criteria, including scalability, adaptability to various incident scenarios, and usability. An experimental evaluation of the proposed architecture was conducted under conditions approximating real-world investigations. The results confirm the practical applicability of the developed assistant in digital forensics tasks and highlight directions for its further development.