Using feature analysis to guide risk calculations of cyber incidents

The prediction of incident features, for example through the use of text analysis and mining techniques, is one method by which the risk underlying Cyber security incidents can be managed and contained. In this paper, we define risk as the product of the probability of misjudging incident features and the impact such misjudgment could have on incident responses. We apply our idea to a simple case study involving a dataset of Cyber intrusion incidents in South Korean enterprises. We investigate a few problems. First, the prediction of response actions to future incidents involving malware and second, the utilisation of the knowledge of the response actions in guiding analysis to determine the type of malware or the name of the malicious code.