Machine learning for automatic assignment of the severity of cybersecurity events. Issue 1 (3rd January 2020)

• Record Type: Journal Article
• Authors: DeCastro‐García, Noemí; Muñoz Castañeda, Ángel L.; Fernández‐Rodríguez, Mario
• Is Part Of: Computational and mathematical methods. Volume 2:Issue 1(2020)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2020-01-03
• Subjects: automatic -- cybersecurity -- machine learning -- model selection; Mathematics -- Data processing -- Periodicals; Numerical analysis -- Periodicals; Numerical analysis; Mathematics -- Data processing; Periodicals; 004.0151
• DOI: 10.1002/cmm4.1072
• Languages: English
• ISSNs: 2577-7408

Abstract

Abstract : The detection, treatment, and prediction of cybersecurity events is a priority research area for the security response centers. In this scenario, the automation of several processes is essential in order to manage and solve, in an efficient way, the possible damaged caused by the threats and attacks to the institutions, citizens, and companies. In this work, automatic multiclass categorization models are created by using machine learning techniques in order to assign the severity for different types of cybersecurity events. Once the machine learning algorithms are applied, we propose a mathematical formula to decide, automatically and based on a scoring system, which model is the best for each type of event. In addition, we present the scoring system applied over a real cybersecurity events data store, then the features are extracted from the usual registers that are collected in a center of response to cyber‐events. The results show that the ensemble methods are the most suitable for obtaining more than 99% of accuracy.