With the growing intensity of global cybersecurity threats and the rapid advancement of attack techniques, strengthening enterprise information and communication technology (ICT) infrastructures and enhancing digital forensics have become critical imperatives. Cloud environments, in particular, present substantial challenges due to the limited availability of effective forensic tools and the pressing demand for impartial and legally admissible digital evidence. To address these challenges, we propose a proactive digital forensics mechanism (P-DFM) designed for emergency incident management in enterprise settings. This mechanism integrates a range of forensic tools to identify and preserve critical digital evidence. It also incorporates the MITRE ATT&CK framework with Security Information and Event Management (SIEM) and Managed Detection and Response (MDR) systems to enable comprehensive and timely threat detection and analysis. The principal contribution of this study is the formulation of a novel Proactive Digital Evidence Forensics Standard Operating Procedure (P-DEFSOP), which enhances the accuracy and efficiency of security threat detection and forensic analysis while ensuring that digital evidence remains legally admissible. This advancement significantly reinforces the cybersecurity posture of enterprise networks. Our approach is systematically grounded in the Digital Evidence Forensics Standard Operating Procedure (DEFSOP) framework and complies with internationally recognized digital forensic standards, including ISO/IEC 27035 and ISO/IEC 27037, to ensure the integrity, reliability, validity, and legal admissibility of digital evidence throughout the forensic process. Given the complexity of cloud computing infrastructures—such as Chunghwa Telecom HiCloud, Amazon Web Services (AWS), Google Cloud, and Microsoft Azure—we underscore the critical importance of impartial and standardized digital forensic services in cloud-based environments.

The escalating threat of global cyberattacks targeting network systems and exfiltrating sensitive information has rendered traditional cybersecurity defense mechanisms increasingly inadequate. Consequently, assisting enterprises in constructing a comprehensive Cyber Threat Intelligence (CTI) aggregation and analysis framework has become critically important. This study aims to address a major pain point faced by cybersecurity analysts—namely, the significant time and resources required to manually process vast amounts of unstructured CTI reports—by proposing an innovative automated analytical solution. The proposed research framework integrates the R programming language with Text Mining and Machine Learning (ML) techniques. Initially, CTI reports collected from institutions such as Taiwan’s National Information Sharing and Analysis Center (N-ISAC) were processed through text mining. Using Term Frequency–Inverse Document Frequency (TF-IDF), we extracted lexical features and constructed a structured dataset. Subsequently, multiple machine learning classifiers were implemented and evaluated, including the C4.5 decision tree, Naive Bayes, Logistic Regression, and Classification and Regression Tree (CART) models, to automatically identify and categorize potential threats and vulnerabilities [1]. Experimental results demonstrated that the Naive Bayes classifier achieved the highest performance with an accuracy rate of 95.48% on the CTI dataset. Moreover, this study successfully implemented a CTI analysis system equipped with visualization capabilities. Empirical validation confirmed that the system significantly reduces the time required for cybersecurity professionals to assess threat intelligence and rapidly generate remediation or hardening strategies for risk mitigation. The proposed research provides enterprises with a high-efficiency, high-accuracy, and scalable CTI analytical tool, effectively enhancing organizational cybersecurity resilience and forensic integrity within Security Information and Event Management (SIEM) and Managed Detection and Response (MDR) environments.