Machine learning approach to quick incident response

Abstract

Tracking the evolution from the first DARPA set designed for IDS ML solutions, more than twenty years later, it can be noticed, that every time a new cybersecurity problem is discovered, unconsidered by previous solutions, a higher-level system is developed to solve it. Training on data specific to the defended system is more effective than training on publicly available datasets. This fact is arguable for the security solutions reviewed, but it is sure for solutions dedicated to incident response and forensics operations. This paper's objective is to design a machine learning-based schema for triage solutions used in quick incident response. More precisely, we evaluated the applicability of machine learning techniques for classifying unknown web access logs.