A cases and clusters framework for recording, retrieving, and reusing response plans in structured cybersecurity incident management

The dynamic and increasing sophistication of cyberattacks and vulnerability exploitation creates a need for Explainable Artificial Intelligence (XAI) approaches that help maintain cyber resilience in organizations. In structured cybersecurity incident management, effective incident response demands explainable outputs from AI-based decision-support systems. To approach this problem, this work presents a framework for reusing concrete experiences of cybersecurity incident response, capturing problem-solving data and knowledge as cases for integrated Case-Based Reasoning (CBR) and Clustering. The contribution includes cluster-based query answer analysis, where cybersecurity analysts reuse clusters of retrieved incident response cases to build answers to new problems. Clustering helps analysts identify relevant groups from ranked lists of retrieved cases, making the reuse process more structured and understandable, especially when dealing with retrieval results for broad and ambiguous queries. Different clustering methods are applied to organize retrieved incident response cases from a case base, supporting the grouping of similar cases for a more straightforward interpretation. Multiple experiments, including cross-validation and real-world incident response testing, are conducted to demonstrate the effectiveness of the proposed framework in improving the decision-support system’s precision. The results indicate that exploring cases and clusters can enhance the selection of incident response procedures for reuse, mainly when analysts identify the most relevant clusters of retrieved cases for the given problem situations. The proposed framework contributes to the organization and understanding of responses to cybersecurity incidents, besides supporting more informed decision-making, ultimately improving cybersecurity incident management.