Multi-criteria recommender approach for supporting intrusion response system

Abstract

Recommender systems are tools for processing and organizing information in order to give assistance to the system users. This assistance is provided by analyzing their own preferences or the preferences of their community. This paper introduces an approach based on content-based recommendation for efficient security administrators assistance in the context of reaction against intrusion detection. The proposed methodology considers the set of active contexts while analyzing the security administrator decisions historic. It provides better recommendation depending on the contexts in which the system is operating. For instance, in an automotive system, given an attack scenario, the fact that a vehicle is operating on downtown or on a highway influences countermeasures selection.