Compositional Machine Learning Method for Computer Security Incidents Response Taxonomy Classification

Incidents handling follows developed methodologies for dealing with incidents such as: cyber-attacks, breaches in the organization's security or remediation of vulnerabilities. The number of discovered vulnerabilities increases every year requiring automation of their processing and classification. Assigning an incident automatically to an element of a classification scheme (taxonomy) will improve the response time and reduce the harmful consequences of the incident. To address these challenges, we propose a compositional ML method called CoMLCSIRT for finding adequate reflection of the classification status of an incident or vulnerability. Our model supports Triaging phase in handling security incidents, outperforms the baseline classification models and performs as well as classification made by human experts but in real-time and without delay.