Assessing cyber-incidents using machine learning

Abstract

One of the difficulties in effectively analysing and combating cyber attacks is an inability to identify when, why and how they occur. Victim organisations do not reveal this data for fear of disclosing vulnerabilities and attackers do not reveal themselves for fear of being prosecuted. In this paper, we employ two machine-learning algorithms to identify: 1) if a text-based report is related to a cyber-incident; 2) the topic within the field of cyber-security the incident report addresses. First, we evaluate the effectiveness of our approach using a benchmark set of cyber-incident reports from 2006. Then, we assess the current state of cyber-security by applying our approach to a 2014 set of cyber-incident reports we gathered. Ultimately, our results show that the combination of automatically gathering and organising cyber-security reports in close to real-time yields an assessment technology with actionable results for intelligence and security analysts.