Case-Based Cybersecurity Incident Resolution
Marcelo Colomé, Raul Ceretta Nunes, Luís A. L. Silva · Proceedings/Proceedings of the ... International Conference on Software Engineering and Knowledge Engineering · 2019
Intelligent computing techniques have a paramount importance to the treatment of cybersecurity incidents.In such Artificial Intelligence (AI) context, while most of the algorithms explored in the cybersecurity domain aim to present solutions to intrusion detection problems, these algorithms seldom approach the correction procedures that are explored in the resolution of cybersecurity incident problems that already took place.In practice, knowledge regarding cybersecurity resolution data and procedures is being under-used in the development of intelligent cybersecurity systems, sometimes even lost and not used at all.In this context, this work proposes to integrate Case-Based Reasoning techniques and IODEF standard in order to retain concrete problem-solving experiences of cybersecurity incident resolution to be reused in the resolution of new incidents.Experimental results so far obtained with a Case-based Cybersecurity Incident Resolution System (CbCSecIRS) implemented show that information security knowledge can be retained in a reusable memory, so improving the resolution of new cybersecurity problems.