An incident response decision support system based on CBR and ontology
Ping Liu, Haifeng Yu, Guoqing Ma · 2010
The similar incident has the similar incident response solution in the information security domain. This spurs us to explore successful past experiences and construct their formal representation so that we can store and share them. Case-based reasoning (CBR) and ontology are means to facilitate fulfilling the above task. This paper designs the incident response decision support system which is based on CBR and ontology. Having given the ontology representation of the security incident, according to the property of incident response an algorithm to get the best match case is presented. Two incident response instances are presented.