Sistema de recomendación para Ciberseguridad basado en un enfoque de ratings

Abstract

The main function of a security analyst is to protect and make the best decisions for preserving the integrity of computer systems within an organization. Every day, they must deal with many anomalies and attacks. To provides a quick response, the analyst usually depends on his good judgement, which should lead him to execute manual processes in a limited time. By dealing with too many anomalies and vulnerabilities, responses are only provided to those threats with the highest level of criticality. This research aims to propose a tool that would help analysts to filter out anomalies, vulnerabilities, and latent risks. To meet this objective, a recommendation system based on collaborative filtering and knowledge was developed, generating ratings of the worst cases with the best recommendations based on expert judgement. During tests, the system allowed an improvement in the response time from analysts to solve problems. It also eliminated the subjectivity of the analyst and reduced the number of manual processes.