A Temporal-Graph-Oriented Formal DFIR Infrastructure with Cryptographic Integrity Assurance and Probabilistic Attack-Chain Reconstruction Capability

1. Introduction

The discipline of Digital Forensics and Incident Response (DFIR) has experienced significant development over the past decade in response to the increasing complexity of digital infrastructures and the substantial expansion of the attack surface in enterprise environments. Modern computing ecosystems integrate cloud services, hybrid environments, microservice architectures, and distributed devices, generating massive volumes of security telemetry. In this context, digital forensic investigations have become a large-scale computational problem that requires automated methods capable of preserving causality and temporal consistency among events (BISHOP, 2018).

Widely documented incidents illustrate this operational complexity. The large-scale exploitation of CVE‑2021‑44228, known as Log4Shell, showed that vulnerabilities in widely used libraries can lead to remote code execution and rapid propagation across enterprise environments (NIST, 2021). Supply-chain attacks, such as the compromise of SolarWinds Orion software, demonstrated that advanced adversaries operate through multi-stage, persistent activities involving initial intrusion, lateral movement, and data exfiltration (MANDIANT, 2023). In contemporary ransomware campaigns carried out by groups such as LockBit and ALPHV/BlackCat, combinations of persistence techniques, abuse of valid credentials, and disabling of auditing mechanisms can also be observed.

Much of this activity can be described using the MITRE ATT&CK framework, which systematizes tactically observed adversary tactics and techniques in real-world attack activities (MITRE, 2024). Techniques such as T1059 (Command and Scripting Interpreter), T1021 (Remote Services), T1078 (Valid Accounts), and T1070 (Indicator Removal) frequently appear in sequence during advanced intrusions. However, despite ATT&CK’s usefulness as a taxonomy for threat analysis, formally reconstructing attack chains from heterogeneous logs remains a major challenge.

A central problem in contemporary DFIR is how to consistently and verifiably reconstruct the causal sequence of events that constitute a security incident. Large organizations commonly generate billions of events per day from EDR systems, firewalls, proxies, identity platforms, and cloud services. Manual analysis of these data has become impractical, while automated approaches based on rules or heuristic correlation often produce false positives or fail to capture relevant causal relationships (ANDERSON, 2020).

Empirical reports further confirm this operational gap. Verizon’s Data Breach Investigations Report shows that attackers often remain in compromised environments for extended periods before being initially detected (VERIZON, 2023). Similarly, operational analyses conducted by Mandiant indicate that a substantial proportion of investigated incidents involve significant lateral movement before the intrusion is identified (MANDIANT, 2023).

In this context, we investigate the following research questions:

RQ1: How can forensic events be formally modeled so as to preserve causality and temporal consistency?

RQ2: Can graph-oriented probabilistic reasoning be used to reconstruct complex attack chains with higher precision?

RQ3: What are the performance and scalability implications of applying such a model to large-scale telemetry environments?

Our main contributions are as follows:

C1: We define a temporal graph formalism for representing digital evidence with explicit completeness and temporal consistency properties.

C2: We propose an attack probability reconstruction algorithm based on Bayesian inference and constrained by ATT&CK framework patterns.

C3: We implement a scalable prototype and conduct an experimental evaluation on representative datasets, demonstrating measurable improvements in investigative precision and reconstruction time.

The remainder of this paper is organized as follows. Section 2 presents the theoretical background and related work. Section 3 formalizes the threat model and the problem under study. Section 4 describes the proposed methodology. Section 5 details the experimental implementation. Section 6 presents the empirical evaluation. Section 7 discusses implications and limitations. Finally, Section 8 concludes the paper.

2. Background and Related Work

Digital forensics is grounded in the four classical phases of digital evidence: acquisition, preservation, analysis, and presentation (KENT et al., 2006). Formally, we may represent a set of observed evidence as:

$E = {e_1, e_2, …, e_n}$

where each event $e_i$ has the following structural attributes:

$(t_i, s_i, m_i)$

where $t_i$ denotes the timestamp, $s_i$ denotes the source (for example, endpoint, firewall, or application), and $m_i$ corresponds to a set of metadata.

Traditional models typically treat events as independent observations, ordering them only by timestamp. This timeline-based approach ignores causal dependencies among computational actions and makes the reconstruction of complex attack chains more difficult (BISHOP, 2018).

As an alternative, provenance graphs have been extensively studied in the systems security literature. In such models, a directed graph $G = (V, E)$ represents computational entities and their interactions, including processes, files, and network connections (BATES et al., 2015).

We can extend this concept by defining a temporal graph as follows:

$G = (V, E, \tau)$

where $\tau : V \rightarrow \mathbb{R}$ associates each vertex with a point in time. The temporal consistency of the graph requires:

$$ \forall (u,v) \in E,\ \tau(u) \leq \tau(v) $$

This property prevents the graph from containing temporally inconsistent causal dependencies.

Several provenance capture systems have been proposed over the past decade. The PASS system introduced provenance tracking at the operating-system level, while the SPADE framework explored the collection of distributed audit events (FREIRE et al., 2008; BATES et al., 2015).

In the specific context of multi-stage attack detection, Milajerdi et al. proposed the HOLMES system, which correlates system events using stages defined by the ATT&CK framework (MILAJERDI et al., 2019). Although effective in detecting malicious behavior, the system does not provide formal guarantees of completeness nor an explicit probabilistic reconstruction mechanism for attack chains.

In enterprise environments, SIEM platforms such as Splunk Enterprise Security and IBM QRadar use rule-based, heuristic, and statistical correlations to identify suspicious patterns (SPLUNK, 2023; IBM, 2023). However, these systems often operate as analytical black boxes, making formal verification of the inferences they produce difficult.

In recent years, modern observability and security architectures have also begun to integrate telemetry from cloud environments and containerized workloads, often correlating such data within CNAPP (Cloud-Native Application Protection Platforms) platforms (SCARFONE; SOUPPAYA, 2022). This expansion of the monitoring surface further reinforces the need for scalable formal models for investigative analysis.

Our approach is distinguished by integrating three complementary dimensions: temporal graph-based formal modeling, ATT&CK-oriented probabilistic reasoning, and cryptographic guarantees of evidence integrity.

3. Threat Model and Problem Formalization

We consider an adversary $\mathcal{A}$ capable of carrying out multi-stage attack activities in enterprise environments monitored by standard logging mechanisms. The assumed capabilities include:

1. Remote exploitation of known vulnerabilities;
2. Arbitrary code execution on compromised hosts;
3. Local privilege escalation;
4. Lateral movement using valid credentials;
5. Attempts to remove or tamper with logs.

These capabilities are consistent with attack patterns documented in the advanced persistent threat (APT) literature (TANKARD, 2011; MITRE, 2024).

We also assume that the monitored infrastructure generates telemetry from multiple sources, including EDR, authentication logs, network flows, and application events. However, these data may exhibit latency, partial loss, or temporal inconsistency.

We define the problem under study as follows. Given a set of observed events $E_{obs}$, we seek to reconstruct a sequence of adversary actions:

$A = (a_1, a_2, …, a_k)$

that maximizes the posterior probability:

$$ A^ = \arg\max_A P(A | E_{obs}) $$

where $A$ represents a chain of techniques compatible with the threat model.

Three fundamental properties are desirable in the system:

Integrity: Recorded evidence must not be altered without detection.

Completeness: All plausible attack chains should be representable in the investigative graph.

Correctness: Inferred chains with probability above a threshold $\theta$ should be consistent with the hypothesized attack model.

These properties provide the theoretical foundation for the proposed architecture.

4. Proposed Method

The GT-DFIR architecture is composed of four main modules:

1. Event ingestion and normalization;
2. Temporal provenance graph construction;
3. Probabilistic reasoning engine;
4. Cryptographic integrity layer.

During the ingestion stage, events from multiple sources are transformed into a unified representation schema. Each event is converted into a typed vertex belonging to one of the following categories: process, file, network, or user.

Algorithm 1: Temporal Graph Construction

Input: Standardized event set E
Output: Temporal graph G

1: Initialize G ← (V = ∅, E = ∅)
2: For each event e ∈ E:
3:     Create vertex v_e
4:     Add v_e to V
5:     Identify causal dependencies D
6:     For each d ∈ D:
7:         Add edge (d, v_e) to E
8:     Return G

When dependency localization uses time indices, the algorithm has approximate complexity $O(n \log n)$.

Algorithm 2: Attack Probability Reconstruction (RPA)

Input: Graph G, set of techniques T
Output: Attack chain A

1: Initialize hypothesis set H
2: For each technique t ∈ T:
3:     Identify compatible subgraph S_t
4:     Estimate probability P(t | S_t)
5:     Update H
6:     Apply Bayesian inference over H
7:     Return the chain with the highest probability

Probabilistic inference is based on the following relation:

$$ P(A|E) \propto P(E|A)P(A) $$

where $P(A)$ denotes the prior probability of the attack chain and $P(E|A)$ corresponds to the likelihood of the observed evidence.

To ensure evidence integrity, we adopt hash-chain cryptography:

$$ h_i = SHA256(e_i || h_{i-1}) $$

This mechanism creates a verifiable chain of records, preventing undetected modification of stored events.

5. Implementation

We implemented an experimental prototype using a distributed architecture composed of eight computing nodes, each equipped with an Intel Xeon Gold processor and 128 GB of RAM.

Event ingestion was performed using the Elastic Stack and normalized according to the Elastic Common Schema (ECS) (ELASTIC, 2024). Temporal graph storage and querying were implemented using Neo4j, a platform that provides efficient support for structured queries and temporal indexing (NEO4J, 2023).

The probabilistic reasoning engine was developed in Python, using scientific computing libraries for conditional probability calculation and graph analysis.

The observed average ingestion rate was approximately 50,000 events per second, with an average processing latency of 220 ms. To ensure horizontal scalability, we adopted partitioning based on temporal windows $\Delta t$, allowing parallel processing across multiple nodes.

6. Experimental Evaluation

The experimental evaluation used three distinct datasets.

Dataset	Size	Description
DARPA Transparent Computing	5.1 TB	Operating-system telemetry for security research
Enterprise logs	4.2 TB	1.3 billion anonymized real-world events
Log4Shell scenario	800 GB	Simulation of CVE‑2021‑44228 exploitation

We compared the proposed architecture against two baseline methods.

Identifier	Method
B1	Rule-based correlation (traditional SIEM)
B2	Independent statistical detection

The evaluation metrics included Precision, Recall, F1-score, and reconstruction time (TR).

Method	Precision	Recall	F1	TR (minutes)
B1	0,74	0,68	0,71	42,3
B2	0,69	0,64	0,66	38,7
GT-DFIR	0,91	0,87	0,89	26,5

We observed an average reduction of 37,4% in investigative reconstruction time ($\sigma = 4,8$). Statistical tests based on the t-test indicated that the difference was significant, with $p < 0,01$.

The average computational overhead introduced by the architecture was 12,6%, a figure considered acceptable given the gains in investigative precision.

7. Discussion

The experimental results show that temporal graph-based modeling can significantly reduce causal ambiguity during forensic investigations. By explicitly representing dependencies among events, the system avoids the erroneous inferences commonly observed in purely chronological approaches.

The use of Bayesian inference also allows the system to incorporate prior knowledge about attack patterns, particularly those documented in the MITRE ATT&CK framework (MITRE, 2024). This integration of expert knowledge and observed evidence improves the robustness of investigative inference.

However, several limitations remain. The quality of inference depends heavily on the completeness and fidelity of the collected telemetry. Environments with insufficient logging may produce incomplete graphs, affecting attack-chain reconstruction.

In addition, large-scale provenance graphs may reach billions of vertices, creating challenges for storage and querying. Event compression and aggregation strategies are promising directions for future research.

From an operational perspective, practical adoption of this architecture requires integration with existing SIEM platforms and incident response toolchains, as well as specialized training for security analysts.

8. Conclusion

We presented a formal architecture for Digital Forensics and Incident Response based on temporal graphs, probabilistic inference, and cryptographic mechanisms for evidence integrity. We showed that, compared with traditional methods relying solely on heuristic correlation, this approach enables more accurate and efficient reconstruction of complex attack chains.

Our contributions include the mathematical formalization of the investigative model, the definition of a probabilistic reconstruction algorithm, and an empirical validation on datasets representative of modern enterprise environments.

The experimental results demonstrate significant improvements in both precision metrics and investigative reconstruction time. These results indicate that temporal graph-based architectures are a promising direction for building scalable and verifiable DFIR systems.

References

ANDERSON, Ross. Security engineering: a guide to building dependable distributed systems. 3. ed. Hoboken: Wiley, 2020. Available at: https://www.cl.cam.ac.uk/~rja14/book.html

BATES, Adam et al. Trustworthy whole-system provenance for the Linux kernel. In: USENIX SECURITY SYMPOSIUM. Proceedings… 2015. Available at: https://www.usenix.org/conference/usenixsecurity15

BILGE, Leyla; DUMITRAȘ, Tudor. Before we knew it: an empirical study of zero-day attacks in the real world. In: ACM CCS. Proceedings… 2012. Available at: https://doi.org/10.1145/2382196.2382284

BISHOP, Matt. Computer security: art and science. 2. ed. Boston: Addison‑Wesley, 2018. Available at: https://www.pearson.com/en-us/subject-catalog/p/computer-security-art-and-science/P200000003095

CARRIER, Brian. File system forensic analysis. Boston: Addison‑Wesley, 2005. Available at: https://www.pearson.com/en-us/subject-catalog/p/file-system-forensic-analysis

DARPA. Transparent computing program. Arlington: DARPA, 2018. Available at: https://www.darpa.mil/program/transparent-computing

ELASTIC. Elastic Common Schema (ECS) reference documentation. 2024. Available at: https://www.elastic.co/guide/en/ecs/current/index.html

FREIRE, Juliana et al. Provenance for computational tasks: a survey. Computing in Science & Engineering, 2008. Available at: https://doi.org/10.1109/MCSE.2008.79

IBM. IBM QRadar SIEM documentation. 2023. Available at: https://www.ibm.com/docs/en/qradar

KENT, Karen et al. Guide to integrating forensic techniques into incident response. NIST Special Publication 800‑86. Gaithersburg: NIST, 2006. Available at: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf

MANDIANT. M‑Trends 2023: insights into today’s cyber attack trends. 2023. Available at: https://www.mandiant.com/resources/m-trends

MILAJERDI, Sadegh M. et al. HOLMES: real-time APT detection through correlation of suspicious information flows. IEEE Symposium on Security and Privacy, 2019. Available at: https://doi.org/10.1109/SP.2019.00044

MITRE. MITRE ATT&CK framework. 2024. Available at: https://attack.mitre.org

NEO4J. Graph database platform documentation. 2023. Available at: https://neo4j.com/docs

NIST. National vulnerability database entry CVE‑2021‑44228. 2021. Available at: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

NIST. Computer security incident handling guide. NIST SP 800‑61 Revision 2. 2012. Available at: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

NOEL, Steven et al. Measuring security risk of networks using attack graphs. IEEE Security & Privacy, 2009. Available at: https://doi.org/10.1109/MSP.2009.64

OWASP. OWASP Top 10: the ten most critical web application security risks. 2021. Available at: https://owasp.org/www-project-top-ten

SCARFONE, Karen; SOUPPAYA, Murugiah. Guidelines on security and privacy in public cloud computing. NIST, 2022. Available at: https://nvlpubs.nist.gov/nistpubs

SPLUNK. Splunk Enterprise Security documentation. 2023. Available at: https://docs.splunk.com/Documentation/ES

TANKARD, Colin. Advanced persistent threats and how to monitor and deter them. Network Security, 2011. Available at: https://doi.org/10.1016/S1353-4858(11)70086-1

VERIZON. 2023 Data breach investigations report. 2023. Available at: https://www.verizon.com/business/resources/reports/dbir/