Neuro Linguistic Programming (NLP) is one of the most utilised approaches for personality development and Meta model is one of the most important techniques in this process. Usually, when one speaks about a problem or a situation, the words that one chooses will delete, distort or generalize portions of their experience. Meta model, which is a set of specific questions or language patterns, can be used to understand and recover the information hidden behind the words used. This technique can be adopted to understand other people's problems or enable them to understand their own issues better. Applying the Meta Model, however, requires a great level of skill and experience for correct identification of deletion, distortion and generalization. Using the appropriate recovery questions is challenging for NLP practitioners and Psychologists. Moreover, the efficiency and accuracy of existing methods on the Meta model can potentially be hindered by human errors such as personal judgment or lack of experience and skill. This research aims to automate the process of using the Meta Model in conversation in order to eliminate human errors, thereby increasing the efficiency and accuracy of this method. An intelligent software has been developed using Natural Language Processing, with the ability to apply the Meta model techniques during conversation with its user. Comparisons of this software with performance of an established NLP practitioner have shown increased accuracy in identification of the deletion and generalization processes. Recovery of information has also been more efficient in the software in comparison to an NLP practitioner.

Purpose -Changing scattered and dynamic business rules in Business Workflow Systems has become a growing problem that hinders the use and configuration of workflow-based applications. There is a gap in the existing research studies which currently focus on solutions that are application specific, without accounting for the universal logical dependencies between the business rules and, as a result, do not support adaptation of the business rules in real time. Design/methodology/approach -To tackle the above problems, this paper adopts a bottom-up approach, which puts forward a component model of the business process workflows and business rules based on purely logical specification which allows incremental development of the workflows and indexing of the rules which govern them during the initial acquisition and real-time execution. Results -The paper introduces a component-based event-driven model for development of business workflows which is purely logicbased and can be easily implemented using an object-oriented technology together with a formal model for accounting the business rules dependencies together with a new method for incremental indexing of the business rules controlling the workflows. It proposes a two-level inference mechanism as a vehicle for controlling the business process execution and adaptation of the business rules at real time based on propagating the dependencies between the rules. Originality/value -The major achievement of this research is the universal, strictly logic-based event-driven framework for business process modelling and control which allows automatic adaptation of the business rules governing the business workflows based on accounting for their structural dependencies. An additional advantage of the framework is its support for object-oriented technology which can be implemented with enterprise-level quality and efficiency. Although developed primarily for application in construction industry the framework is entirely domain-independent and can be used in other industries, too.

SOTER 1 , a cyber security incident management playbook, is developed to provide a comprehensive model to manage cyber security incidents, particularly for the cyber security operations centre. The proposed playbook is adaptive, cross-sectorial, and process driven. Each key components of the incident management playbook are outlined and discussed. Further, a lexicon based on equivalence mapping is developed and used to map existing cyber security incident vocabulary and taxonomy into a common and consistent lexicon to aid understanding among incident management stakeholder communitiesnational, government and private sectors. A versatile workbook model has been explored which proves to be adaptable to serve a wide range of cases for successfully managing government and private sector security operations centre.Cyber security incident sharing partnership, formalism for metric and measurements of cyber security incident parameters, and cyber security incident classification and prioritisation schemes are presented, and finally, cyber security incident 'plays' and playbook templates are discussed.

Cyber security operations centre (CSOC) is a horizontal business function responsible primarily for managing cyber incidents, in addition to cyber-attack detection, security monitoring, security incident triage, analysis and coordination. To monitor systems, networks, applications and services the CSOC must first on-board the systems and services onto their security monitoring and incident management platforms. Cyber Onboarding (a.k.a. Onboarding) is a specialist technical process of setting up and configuring systems and services to produce appropriate events, logs and metrics which are monitored through the CSOC security monitoring and incident management platform. First, logging must be enabled on the systems and applications, second, they must produce the right set of computing and security logs, events, traps and messages which are analysed by the detection controls, security analytics systems and security event monitoring systems such as SIEM, and sensors etc.; and further, network-wide information e.g. flow data, heartbeats and network traffic information are collected and analysed, and finally, threat intelligence data are ingested in real-time to detect, or be informed of threats which are out in the wild. While setting up a CSOC could be straightforward, unfortunately, the 'people' and 'process' aspects that underpin the CSOC are often challenging, complicated and occasionally unworkable. In this paper, CSOC and Cyber Onboarding are thoroughly discussed, and the differences between SOC vs SIEM are explained. Key challenges to Cyber Onboarding are identified through the reframing matrix methodology, obtained from four notable perspectives -Cyber Onboarding Perspective, CSOC Perspective, Client Perspective and Senior Management Team Perspective. Each of the views and interests are discussed, and finally, recommendations are provided based on lessons learned implementing CSOCs for many organisationse.g. government departments, financial institutions and private sectors.

In cyber security, it is critical that event data is collected in as near real time as possible to enable early detection and response to threats. Performing analytics from event logs stored in databases slows down the response time due to the time cost of database insertion and retrieval operations. The authors present a data collection framework that minimizes the need for long-term storage. Events are buffered in memory, up to a configurable threshold, before being streamed in real time using live streaming technologies. The framework deploys virtualized data collecting agents that ingest data from multiple sources including threat intelligence. The framework enables the correlation of events from various sources, improving detection precision. The authors have tested the framework in a real time, machine-learning-based threat detection system. The results show a time gain of 300 milliseconds in transmission time from event capture to analytics system, compared with storage-based collection frameworks. Threat detection was measured at 95%, which is comparable to the benchmark snort IDS.