Cyber incident classification: Issues and challenges

Abstract

The cyber threat landscape is changing rapidly thus making the process of scientific classification of incidents for the purpose of incident response management difficult. Additionally, there are no universal methodologies for sharing information on cyber security incidents between private and public sectors. Existing efforts to automate the process of incident classification do not make a distinction between ordinary events and threatening incidents, which can cause issues that permeate throughout the entire incident response process. We describe a machine learning model to determine the probability that an event is an incident using contextual information of the event.