Boosted CSIRT with AI powered open source framework
Rubén García Maezo, Alejandro Echeverría Rey · 2023
This study presents a novel framework leveraging the potential of Artificial Intelligence (AI) in enhancing the efficacy of Computer Security Incident Response Teams (CSIRTs). It advocates the synergy of AI and open-source resources, tailored to provide robust, case-specific, and flexible solutions. The framework emphasizes the role of AI-based prediction models and anomaly detection techniques in accelerating incident response, increasing threat detection accuracy, and reducing false positives. Additionally, it elucidates the challenges of AI integration into existing CSIRT operations and offers guidance for seamless assimilation. In conclusion, this study posits the availability of cost-effective, auditable, scalable, and custom-fit open-source solutions for AI implementation, with trans-formative potential for CSIRT practice and incident response optimization.