Application of the Metric Learning for Security Incident Playbook Recommendation

The article describes an algorithm for the automated selection of the most relevant playbook for responding to computer security precedents. The proposed approach is based on the methodology of metric learning. During the execution of the algorithm, it analyzes the precedents recorded in the past and the playbooks used for them. A trained neural network maps the entire set of precedents into a vector space, in which precedents with the same playbooks are closer to each other than to precedents with different playbooks. This method does not require the involvement of object domain experts and additional training of the network when expanding the set of precedents or playbooks. The developed approach was tested on real data. Experiments show that the proposed method can be effectively used to playbook's recommendation.