{"id":"https://openalex.org/W4416695809","doi":"https://doi.org/10.3390/jcp5040105","title":"A Game-Theoretic Approach for Quantification of Strategic Behaviors in Digital Forensic Readiness","display_name":"A Game-Theoretic Approach for Quantification of Strategic Behaviors in Digital Forensic Readiness","publication_year":2025,"publication_date":"2025-11-26","ids":{"openalex":"https://openalex.org/W4416695809","doi":"https://doi.org/10.3390/jcp5040105"},"language":"en","primary_location":{"id":"doi:10.3390/jcp5040105","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040105","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/jcp5040105","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120044954","display_name":"Mehrnoush Vaseghipanah","orcid":"https://orcid.org/0000-0003-3928-9561"},"institutions":[{"id":"https://openalex.org/I136830121","display_name":"Islamic Azad University South Tehran Branch","ror":"https://ror.org/02xc21a77","country_code":"IR","type":"education","lineage":["https://openalex.org/I110525433","https://openalex.org/I136830121"]},{"id":"https://openalex.org/I183067279","display_name":"Islamic Azad University North Tehran Branch","ror":"https://ror.org/00sb1nr29","country_code":"IR","type":"education","lineage":["https://openalex.org/I110525433","https://openalex.org/I183067279"]}],"countries":["IR"],"is_corresponding":false,"raw_author_name":"Mehrnoush Vaseghipanah","raw_affiliation_strings":["Department of Computer, NT.C., Islamic Azad University, Tehran 1651153511, Iran","Department of Computer, Tehran North Branch, Islamic Azad University, Tehran 1651153511, Iran"],"raw_orcid":"https://orcid.org/0000-0003-3928-9561","affiliations":[{"raw_affiliation_string":"Department of Computer, NT.C., Islamic Azad University, Tehran 1651153511, Iran","institution_ids":["https://openalex.org/I136830121","https://openalex.org/I183067279"]},{"raw_affiliation_string":"Department of Computer, Tehran North Branch, Islamic Azad University, Tehran 1651153511, Iran","institution_ids":["https://openalex.org/I183067279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023010937","display_name":"Sam Jabbehdari","orcid":"https://orcid.org/0000-0001-5168-5271"},"institutions":[{"id":"https://openalex.org/I136830121","display_name":"Islamic Azad University South Tehran Branch","ror":"https://ror.org/02xc21a77","country_code":"IR","type":"education","lineage":["https://openalex.org/I110525433","https://openalex.org/I136830121"]},{"id":"https://openalex.org/I183067279","display_name":"Islamic Azad University North Tehran Branch","ror":"https://ror.org/00sb1nr29","country_code":"IR","type":"education","lineage":["https://openalex.org/I110525433","https://openalex.org/I183067279"]}],"countries":["IR"],"is_corresponding":true,"raw_author_name":"Sam Jabbehdari","raw_affiliation_strings":["Department of Computer, NT.C., Islamic Azad University, Tehran 1651153511, Iran","Department of Computer, Tehran North Branch, Islamic Azad University, Tehran 1651153511, Iran"],"raw_orcid":"https://orcid.org/0000-0001-5168-5271","affiliations":[{"raw_affiliation_string":"Department of Computer, NT.C., Islamic Azad University, Tehran 1651153511, Iran","institution_ids":["https://openalex.org/I136830121","https://openalex.org/I183067279"]},{"raw_affiliation_string":"Department of Computer, Tehran North Branch, Islamic Azad University, Tehran 1651153511, Iran","institution_ids":["https://openalex.org/I183067279"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5077522986","display_name":"Hamidreza Navidi","orcid":"https://orcid.org/0000-0003-1072-8786"},"institutions":[{"id":"https://openalex.org/I119025939","display_name":"Shahed University","ror":"https://ror.org/01e8ff003","country_code":"IR","type":"education","lineage":["https://openalex.org/I119025939"]}],"countries":["IR"],"is_corresponding":false,"raw_author_name":"Hamidreza Navidi","raw_affiliation_strings":["Department of Mathematics and Computer Sciences, Shahed University, Tehran 3319118651, Iran"],"raw_orcid":"https://orcid.org/0000-0003-1072-8786","affiliations":[{"raw_affiliation_string":"Department of Mathematics and Computer Sciences, Shahed University, Tehran 3319118651, Iran","institution_ids":["https://openalex.org/I119025939"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5023010937"],"corresponding_institution_ids":["https://openalex.org/I136830121","https://openalex.org/I183067279"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.42331012,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"5","issue":"4","first_page":"105","last_page":"105"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.7041000127792358,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.7041000127792358,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.08659999817609787,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.04600000008940697,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/offensive","display_name":"Offensive","score":0.6233000159263611},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.612500011920929},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5388000011444092},{"id":"https://openalex.org/keywords/analytic-hierarchy-process","display_name":"Analytic hierarchy process","score":0.5335999727249146},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4546999931335449},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"Digital forensics","score":0.4311000108718872},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.38929998874664307},{"id":"https://openalex.org/keywords/nash-equilibrium","display_name":"Nash equilibrium","score":0.36239999532699585}],"concepts":[{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.6233000159263611},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.612500011920929},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6054999828338623},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5788000226020813},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5388000011444092},{"id":"https://openalex.org/C87345402","wikidata":"https://www.wikidata.org/wiki/Q485202","display_name":"Analytic hierarchy process","level":2,"score":0.5335999727249146},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4546999931335449},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.4311000108718872},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4196000099182129},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.38929998874664307},{"id":"https://openalex.org/C46814582","wikidata":"https://www.wikidata.org/wiki/Q23389","display_name":"Nash equilibrium","level":2,"score":0.36239999532699585},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.3427000045776367},{"id":"https://openalex.org/C177142836","wikidata":"https://www.wikidata.org/wiki/Q44455","display_name":"Game theory","level":2,"score":0.34060001373291016},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.3400000035762787},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3386000096797943},{"id":"https://openalex.org/C155223936","wikidata":"https://www.wikidata.org/wiki/Q682875","display_name":"Domino effect","level":2,"score":0.3321000039577484},{"id":"https://openalex.org/C2779304628","wikidata":"https://www.wikidata.org/wiki/Q3503480","display_name":"Face (sociological concept)","level":2,"score":0.3158000111579895},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.3118000030517578},{"id":"https://openalex.org/C2777042776","wikidata":"https://www.wikidata.org/wiki/Q4583103","display_name":"Preparedness","level":2,"score":0.30219998955726624},{"id":"https://openalex.org/C113336015","wikidata":"https://www.wikidata.org/wiki/Q574010","display_name":"Complete information","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C31170391","wikidata":"https://www.wikidata.org/wiki/Q188619","display_name":"Hierarchy","level":2,"score":0.28290000557899475},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.2687999904155731},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2538999915122986}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/jcp5040105","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040105","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:49768f804e8a41fb99853e49482b72a2","is_oa":true,"landing_page_url":"https://doaj.org/article/49768f804e8a41fb99853e49482b72a2","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 5, Iss 4, p 105 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp5040105","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040105","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W59413458","https://openalex.org/W633428226","https://openalex.org/W1539707978","https://openalex.org/W1964439345","https://openalex.org/W1968909445","https://openalex.org/W1992758609","https://openalex.org/W2015548170","https://openalex.org/W2032386914","https://openalex.org/W2067064328","https://openalex.org/W2069038223","https://openalex.org/W2573841943","https://openalex.org/W2628759714","https://openalex.org/W2746119360","https://openalex.org/W2748227469","https://openalex.org/W2898706108","https://openalex.org/W2907825110","https://openalex.org/W3024339044","https://openalex.org/W3043972094","https://openalex.org/W3090744703","https://openalex.org/W3096055900","https://openalex.org/W3119729076","https://openalex.org/W3129823553","https://openalex.org/W3176289544","https://openalex.org/W3193137214","https://openalex.org/W4211043782","https://openalex.org/W4236158019","https://openalex.org/W4245699803","https://openalex.org/W4250589301","https://openalex.org/W4310683262","https://openalex.org/W4311548908","https://openalex.org/W4316469860","https://openalex.org/W4317642397","https://openalex.org/W4382724556","https://openalex.org/W4403029126","https://openalex.org/W4406376113","https://openalex.org/W4409804607"],"related_works":[],"abstract_inverted_index":{"Small":[0],"and":[1,25,52,75,85,105,116,130,168,193,215],"Medium-sized":[2],"Enterprises":[3],"(SMEs)":[4],"face":[5],"disproportionately":[6],"high":[7],"risks":[8],"from":[9,204],"Advanced":[10],"Persistent":[11],"Threats":[12],"(APTs),":[13],"which":[14,123],"often":[15],"evade":[16],"traditional":[17],"cybersecurity":[18],"measures.":[19],"Existing":[20],"frameworks":[21,77],"catalogue":[22],"adversary":[23],"tactics":[24,129],"defensive":[26,83],"solutions":[27],"but":[28,198],"provide":[29],"limited":[30,35],"quantitative":[31],"guidance":[32,224],"for":[33,61,102,225],"allocating":[34],"resources":[36],"under":[37],"uncertainty,":[38],"a":[39,58,111,118,137,147,190],"challenge":[40],"amplified":[41],"by":[42,177],"the":[43,72,93,124,131,144,184,205,218],"growing":[44],"use":[45],"of":[46,151,183],"AI":[47],"in":[48,67,122,166],"both":[49,103],"offensive":[50],"operations":[51],"digital":[53,63],"forensics.":[54],"This":[55],"paper":[56],"proposes":[57],"game-theoretic":[59],"model":[60],"improving":[62],"forensic":[64,169,227],"readiness":[65,149],"(DFR)":[66],"SMEs.":[68],"The":[69,107],"approach":[70],"integrates":[71],"MITRE":[73],"ATT&CK":[74],"D3FEND":[76],"to":[78,82,98,157,160],"map":[79],"APT":[80],"behaviors":[81],"countermeasures":[84],"defines":[86],"32":[87],"custom":[88],"DFR":[89],"metrics,":[90],"weighted":[91],"using":[92],"Analytic":[94],"Hierarchy":[95],"Process":[96],"(AHP),":[97],"derive":[99],"utility":[100,175],"functions":[101],"attackers":[104],"defenders.":[106],"main":[108],"analysis":[109],"considers":[110],"non-zero-sum":[112,207],"attacker\u2013defender":[113],"bimatrix":[114],"game":[115,185],"yields":[117],"single":[119],"Nash":[120],"equilibrium":[121],"attacker":[125,174],"concentrates":[126],"on":[127,133,211],"Impact-oriented":[128],"defender":[132],"Detect-focused":[134],"controls.":[135],"In":[136],"synthetic":[138,216],"calibration":[139],"across":[140],"ten":[141],"organizational":[142],"profiles,":[143,217],"framework":[145,219],"achieves":[146],"median":[148],"improvement":[150],"18.0%":[152],"(95%":[153],"confidence":[154],"interval:":[155],"16.3%":[156],"19.7%)":[158],"relative":[159],"pre-framework":[161],"baselines,":[162],"with":[163],"targeted":[164],"improvements":[165],"logging":[167],"preservation":[170],"typically":[171],"reducing":[172],"key":[173],"components":[176],"around":[178],"15\u201330%.":[179],"A":[180],"zero-sum":[181],"variant":[182],"is":[186],"also":[187],"analyzed":[188],"as":[189],"robustness":[191],"check":[192],"exhibits":[194],"consistent":[195],"tactical":[196],"themes,":[197],"all":[199],"policy":[200],"conclusions":[201],"are":[202],"drawn":[203],"empirical":[206],"model.":[208],"Despite":[209],"relying":[210],"expert-driven":[212],"AHP":[213],"weights":[214],"offers":[220],"SMEs":[221],"actionable,":[222],"equilibrium-informed":[223],"strengthening":[226],"preparedness":[228],"against":[229],"advanced":[230],"cyber":[231],"threats.":[232]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-11-27T00:00:00"}