Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F21%3A00122713" target="_blank" >RIV/00216224:14610/21:00122713 - isvavai.cz</a>
Result on the web
<a href="https://ieeexplore.ieee.org/abstract/document/9624774" target="_blank" >https://ieeexplore.ieee.org/abstract/document/9624774</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/ISI53945.2021.9624774" target="_blank" >10.1109/ISI53945.2021.9624774</a>

Result language
angličtina
Original language name
Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents
Original language description
Effective triage is of utmost importance for cybersecurity incident response, namely in handling ransomware or similar incidents in which the attacker may use self-propagating worms, infected files, or email attachments to spread malware. If a device is infected, it is vital to know which other devices can be infected too or are immediately threatened. The number and heterogeneity of devices in today's network complicate situational awareness of incident handlers, and, thus, we propose a recommender system that uses network monitoring data to prioritize devices in the network based on their similarity and proximity to an already infected device. The system enumerates devices in close proximity in terms of physical and logical network topology and sorts them by their similarity given by the similarity of their behavioral profile, fingerprint, or common history. The incident handlers can use the recommendation to promptly prevent malware from spreading or trace the attacker's lateral movement.
Czech name
—
Czech description
—

Project
<a href="/en/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year
2021
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection
2021 IEEE International Conference on Intelligence and Security Informatics (ISI)
ISBN
9781665438384
ISSN
—
e-ISSN
—
Number of pages
6
Pages from-to
1-6
Publisher name
IEEE
Place of publication
San Antonio
Event location
San Antonio
Event date
Nov 2, 2021
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—

Similar results(10)