A new algorithm of quantitative analyzing complex incident response plan

In order to respond the information security incident, we must make plans of incident response. We also need to summarize and analyze the past incident response method so as to accumulating successful incident response experience. Two problems were studied in this paper. At first we present a method of decomposing and describing complex incident response plans. The action decomposing method is used to decompose the incident response method. The second is an algorithm of analyzing incident responses plans that based on the method of decomposing and describing complex incident responses plans.