Incident Response Probabilistic Cognitive Maps

Abstract

Security incident response is a major activity to guarantee the protection of information systems. We develop in this paper a methodology for automatically determining responses to security incidents based on a new category of cognitive maps, referred to as incident response probabilistic cognitive map. The main issue addressed in this paper is the development of a methodology using mathematical tools for reasoning about the constructed cognitive map to identify the attack, to reduce its complexity, and to search for the decision responding to the detected attack. The main features have been highlighted showing the complexity of the incident response team role.