Priority Based Cyber Incident Handling: Work in Progress

Effective and efficient cyber incident handling is crucial for maintaining the security of information systems and organizational data. This research aims to develop a priority-based cyber incident handling method by adopting the NIST 2.0 framework and utilizing machine learning classification algorithms. This method enables organizations to quickly and accurately identify and respond to incidents based on threat levels and impact, focusing resources on the most critical incidents. The research employs the Support Vector Machine (SVM) classification algorithm to determine incident priorities. The study is still developing for handling cyber incidents, followed by testing and evaluating the system prototype within organizations. Initial results indicate that the priority-based approach using the SVM classification algorithm achieves a True Positive (TP) Rate of 0.999 and a False Positive (FP) Rate of 0.008, with a correlation of 98.88%, resulting in excellent performance in identifying positive cases and a low error rate.