A Game Theoretical Approach for Quantification of Strategic Behaviors in Digital Forensic Readiness

Small and Medium-sized Enterprises (SMEs) face disproportionately high risks from Advanced Persistent Threats (APTs), which often evade traditional cybersecurity measures. While existing frameworks catalogue adversary tactics and defensive solutions, they offer limited quantitative guidance for optimal resource allocation under uncertainty—a challenge intensified by the proliferation of AI, which empowers both adaptive attacks and forensic complexity. To address this gap, we propose a novel game-theoretic model for enhancing Digital Forensic Readiness (DFR). Our methodology integrates the MITRE ATT&CK and D3FEND frameworks to systematically map APT behaviors to defensive countermeasures. We then define 32 custom DFR metrics, weighted via the Analytic Hierarchy Process (AHP), to compute quantitative utility functions for both adversaries and defenders. Equilibrium analysis reveals one Pure Nash Equilibrium (PNE) and five Mixed Nash Equilibria (MNE), indicating that allocating 90–95% of resources to proactive control modeling, while reserving a smaller portion for real-time detection, yields optimal strategic resilience. Simulations demonstrate that this strategy reduces attacker success rates by up to 30% in multi-vector APT scenarios. Furthermore, comparative analysis shows that SMEs with weak logging and limited forensic capabilities suffer 15–25% higher attack success rates; however, readiness improves markedly with enhanced data preservation and logging quality. Although the model’s precision depends on AHP weighting assumptions, the proposed framework provides SMEs with actionable, equilibrium-informed strategies to significantly improve forensic preparedness and mitigate advanced cyber threats.