Sistema de recomendação de alertas cibernéticos: projeto e desenvolvimento

Abstract

The growing number of threats and vulnerabilities being reported on the Internet makes it difficult for network administrators to identify relevant alerts, considering their organizations’ technology infrastructure. Therefore, highlighting such alerts would make it possible to provide early or faster responses to these threats. Thus, this work aims to develop a recommendation system for cyber alerts that facilitates access to alerts that evidence vulnerabilities or threats to the security of systems used by each user and/or organization. In this context, the recommendation model and a scalable architecture were developed for the maintenance and performance of the system. The system was evaluated in stress tests and the recommendation model through a synthetic database. As results, the system supported a high load of requests and the implementation of the model proved feasible for the recommendation of alerts, although it still needed adjustments and further tests. It was found that the system and recommendation model can handle high load of alerts and recommend alerts of interest to the administrator.