Improving Cybersecurity Incident Analysis Workflow with Analytical Provenance

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F22%3A00126006" target="_blank" >RIV/00216224:14610/22:00126006 - isvavai.cz</a>

Result on the web

<a href="http://dx.doi.org/10.1109/IV56949.2022.00058" target="_blank" >http://dx.doi.org/10.1109/IV56949.2022.00058</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/IV56949.2022.00058" target="_blank" >10.1109/IV56949.2022.00058</a>

Result language

angličtina

Original language name

Improving Cybersecurity Incident Analysis Workflow with Analytical Provenance

Original language description

Cybersecurity incident analysis is an exploratory, data-driven process over records and logs from network monitoring tools. The process is rarely linear and frequently breaks down into multiple investigation branches. Analysts document all the steps and lessons learned and suggest mitigations. However, current tools provide only limited support for analytical provenance. As a result, analysts have to record all the details regarding the performed steps and notes in separate documents. Such a procedure increases their cognitive demands and is naturally error-prone. This paper proposes a conceptual design of the analytical tool implementing means of analytical provenance in cybersecurity incident analysis workflows. We identified the user requirements and designed and implemented a proof of concept prototype application Incident Analyzer. Qualitative feedback from four domain experts confirmed that our approach is promising and can significantly improve current cybersecurity and network incident analysis practices.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: CyberSecurity, CyberCrime and Critical Information Infrastructures Center of Excellence</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

2022 26th International Conference Information Visualisation (IV)

ISBN

9781665490078

ISSN

—

e-ISSN

—

Number of pages

7

Pages from-to

300-306

Publisher name

IEEE

Place of publication

Vienna, Austria

Event location

Vienna

Event date

Jul 19, 2022

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—