Cyber Incident Response Systems Using Machine Learning and Severity Ranking Algorithm

Cyber incident response is an essential framework that organizations employ to effectively manage the aftermath of cyberattacks or security breaches, aiming to mitigate impacts and ensure swift recovery. Adopting Artificial Intelligence (AI) significantly advances threat detection, classification, and response efficiency. The study underscores transitioning from traditional methods to a more advanced, automated system leveraging machine learning algorithms. Various models, including Logistic Regression, Random Forest, Support Vector Classifier, Decision Tree Classifier, and Histogram Gradient Boosting Classifier, were trained and evaluated, demonstrating high accuracy in classifying network traffic and identifying cyber threats. Central to this study is the Severity Ranking Algorithm, which quantifies incident severity by integrating intensity, frequency, and potential impact, derived from a linear regression model. This algorithm enables dynamic prioritization of incidents, ensuring efficient resource allocation and timely responses. The stratification of incidents into low, medium, and high-severity categories, based on calculated severity scores, further streamlines incident response processes. The implementation highlights the effectiveness of machine learning models in enhancing cybersecurity measures. The developed Cyber Incident Response System demonstrates significant advancements in threat detection and response.