Automated planning for incident response based on CBR

Abstract

Although the new type of network security incidents continue to occur, most security incidents are similar, the response methods have in common, so CBR (Case Based Reasoning) technology can be used to describe the successful experience of the past incident response. Based on past examples of how to develop rapid response strategy is the key to incident responses. Automated planning method can greatly improve the efficiency and level of decision making. According to the characteristics of incident responses, combined with automatic planning method, CBR technology and ontology technology, a novel approach of getting incident response methods is presented.