A Risk Index Model for Security Incident Prioritisation

摘要: With thousands of incidents identified by security appliances every day, the process distinguishing which are important and trivial is complicated. This paper proposes an incident prioritisation model, Risk Index Model (RIM), based on risk assessment Analytic Hierarchy Process (AHP). The model uses indicators, such as criticality, maintainability, replaceability, dependability decision factors to calculate incidents’ index. RIM was validated using MIT DARPA LLDOS 1.0 dataset, results were compared against combined priorities Common Vulnerability Scoring System (CVSS) v2 Snort Priority. experimental have shown that 100% could be rated with RIM, only 17.23% CVSS. In addition, this study also improves limitation group priority in Priority (e.g. high, medium low priority) quantitatively ranking, sorting listing according their proposed has investigated effect applying weighted indicators at calculation index, well calculating them dynamically. experiments significant changes resultant index some top rankings.