An expert system for mitigation actions

Abstract

This paper describes an approach, based on ontologies and expert system technology, for assisting the mitigation of advanced persistent threat (APT) attacks against critical infrastructures. We describe the approach, and a prototype expert system based on it. We delineate a case study, involving an APT against a financial information infrastructure. Finally, we outline some conclusions and recommendations for future work.