Haula Galadima, PhD researcher at the ADAPT Centre, University College Dublin, has presented new research on analysing cyber incident response processes at the International Conference on Availability, Reliability and Security (ARES) in Sweden.
Her paper, “Graph Analysis of Incident Response Process Activities and Communications,” introduces a knowledge graph approach designed to bring together incident response activities and responder communications from different security tools into a unified, end-to-end view.
The research centres on the Cyber Incident Response Process Ontology (CIRPO), which brings together IR activities and responder communication data from heterogeneous IR tools for a unified, end to end process analysis. The team evaluated the approach through schema validation, a 100% Findable, Accessible, Interoperable, Reusable (FAIR) assessment score, and an IR case study based on a live simulated ransomware exercise involving professional security teams.
The work builds on an earlier semantic log aggregation prototype and was conducted with co-authors and supervisors Rob Brennan and Cormac Doherty of the ADAPT Centre and UCD School of Computer Science.
Haula continues to run incident response workshops using anonymised live ransomware exercises, helping security teams examine and improve their response processes.
Read the paper: Graph Analysis of Incident Response Process Activities and Communications
Find out more about the incident response workshops: Incident Response Research & Workshops.
