SoK: Applications and Challenges of using Recommender Systems in Cybersecurity Incident Handling and Response

Investor logo

Warning

This publication doesn't include Faculty of Economics and Administration. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

HUSÁK Martin ČERMÁK Milan

Year of publication 2022
Type Article in Proceedings
Conference The 17th International Conference on Availability, Reliability and Security (ARES 2022)
MU Faculty or unit

Institute of Computer Science

Citation
Web https://dl.acm.org/doi/10.1145/3538969.3538981
Doi http://dx.doi.org/10.1145/3538969.3538981
Keywords Recommender System;Incident Handling;Incident Response
Attached files
Description Incident handling, a fundamental activity of a cybersecurity incident response team, is a complex discipline that consumes a significant amount of personnel's time and costs. There are continuous efforts to facilitate incident handling and response in terms of providing procedural or decision support and processing relevant data. In this paper, we survey the approaches towards (semi-)automated incident handling and response backed by recommender systems that are successful in other domains. We discuss which phases and tiers of incident handling can be automated and to what level while evaluating the maturity of proposed approaches and tools. While we did not find a full-scale recommender system that would guide the user through incident handling and suggest which steps to take, many of them aim at particular problems. The discussed issues are not resolved yet but seem to get the attention of researchers and will likely be investigated in the future.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.