A Recommender System for Tracking Vulnerabilities

Huff, Philip; McClanahan, Kylie; Le, Thao Thu Dao; Li, Qinghua

doi:10.1145/3465481.3470039

Cited by 14 publications

(1 citation statement)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Polatidis et al [12] were inspired by a product recommender system in designed a system for attack prediction. Recommender systems are also considered in vulnerability assessment and scoring [13], [14]. Identification of systems at risk via analysis of discussion on the darkweb can be found in work by Almukaynizi, et al [15].…”

Section: Background and Related Workmentioning

confidence: 99%

Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents

Husák

2021

2021 IEEE International Conference on Intelligence and Security Informatics (ISI)

View full text Add to dashboard Cite

Effective triage is of utmost importance for cybersecurity incident response, namely in handling ransomware or similar incidents in which the attacker may use self-propagating worms, infected files, or email attachments to spread malware. If a device is infected, it is vital to know which other devices can be infected too or are immediately threatened. The number and heterogeneity of devices in today's network complicate situational awareness of incident handlers, and, thus, we propose a recommender system that uses network monitoring data to prioritize devices in the network based on their similarity and proximity to an already infected device. The system enumerates devices in close proximity in terms of physical and logical network topology and sorts them by their similarity given by the similarity of their behavioral profile, fingerprint, or common history. The incident handlers can use the recommendation to promptly prevent malware from spreading or trace the attacker's lateral movement.

show abstract