Design and Generation of a Set of Declarative APIs for Security Orchestration
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216208%3A11320%2F25%3AMJWI7AXW" target="_blank" >RIV/00216208:11320/25:MJWI7AXW - isvavai.cz</a>
Alternative codes found
RIV/00216208:11320/23:FCFCBWMP
Result on the web
<a href="https://www.scopus.com/inward/record.uri?eid=2-s2.0-85179115313&doi=10.1109%2fTSC.2023.3336666&partnerID=40&md5=04abb6d69632ab409bad1165fd770027" target="_blank" >https://www.scopus.com/inward/record.uri?eid=2-s2.0-85179115313&doi=10.1109%2fTSC.2023.3336666&partnerID=40&md5=04abb6d69632ab409bad1165fd770027</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/TSC.2023.3336666" target="_blank" >10.1109/TSC.2023.3336666</a>
Alternative languages
Result language
angličtina
Original language name
Design and Generation of a Set of Declarative APIs for Security Orchestration
Original language description
The emerging threat landscape causes continuous change in the Incident Response Process (IRP) and security tools of security orchestration platforms (SOAR). Users of such platforms often struggle to adapt to these changes because they are addressed in an ad-hoc manner through a complex architecture. The complex design of the SOAR can be hidden behind an easy-to-use user interface. This article introduces a Declarative API (DAPI)-driven Orchestration approach, DecOr, that alleviates the need for security teams' detailed understanding of the libraries and plugins to address the changes of a SOAR. DecOr comprises 1) three sets of dAPIs to encapsulate the activities of security orchestration and 2) a semantic framework to support the design and generation of dAPIs from task descriptions, leveraging natural language processing techniques. The dAPIs are mapped with an ontological knowledge base to execute IRPs. We experimentally evaluate the effectiveness and efficiency of DecOr based on 147 task and dAPI pairs, curated from real-world playbooks. We show the end-to-end process from identifying dAPIs to executing 48 IRPs with seven security tools. The evaluation results show, DecOr accurately generates dAPIs in near real-time, with precision and recall values over 80% and successfully executes changing IRPs 93% of the time. © 2008-2012 IEEE.
Czech name
—
Czech description
—
Classification
Type
J<sub>SC</sub> - Article in a specialist periodical, which is included in the SCOPUS database
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
—
Continuities
—
Others
Publication year
2024
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Name of the periodical
IEEE Transactions on Services Computing
ISSN
1939-1374
e-ISSN
—
Volume of the periodical
17
Issue of the periodical within the volume
1
Country of publishing house
US - UNITED STATES
Number of pages
15
Pages from-to
127-141
UT code for WoS article
—
EID of the result in the Scopus database
2-s2.0-85179115313