TTPs -based cybercrime investigation framework

Cybercrime investigation tool, known as the TTPs (tactics, techniques, and procedures)-based cybercrime investigation framework, is set to transform the way cybercrimes targeting individuals.

About TTPs-based Framework:

• It is developed with support from the Department of Science and Technology (DST) under the National Mission on Interdisciplinary Cyber-Physical Systems (NM-ICPS) by the I-hub NTIHAC foundation (c3ihub) at IIT Kanpur.
• The process involved:
  • Extensive literature study,
  • Real case studies,
  • Framework construction,
  • Incorporation of existing crime patterns,
  • Evolution of an interactive framework navigator, and
  • Mapping of actual cases onto the framework.

Key Features:

The innovative technology within the framework has the capability to:

• Extract Essential Information: It can extract key points from the victim’s FIR, providing investigators with vital insights into the reported cybercrime.
• Establish Crime Paths: By indicating steps based on pre-existing crime paths, it guides investigators in a systematic and methodical manner.
• Evidentiary Mapping: It can map evidences to the steps taken, facilitating informed decisions and conclusions in the investigative process.
• User-Derived Keywords: It can create approximate crime execution paths and suggest crime paths based on user-derived sets of keywords.
• Comparative Analysis: It allows for a comparative analysis of the modus operandi used in different cybercrimes, enhancing the ability to identify patterns.

Challenges in Cybercrime Investigations

• The significant disparity between the number of reported cybercrimes and the number of investigations undertaken.
• Compounded by the fact that many victims have low cyber literacy, investigations often rely solely on the narratives provided in First Information Reports (FIRs) by victims, which can be misleading and distracting.

Ref: Source