An Intelligent Playbook Recommendation Algorithm Based on Dynamic Interest Modeling for SOAR

With the growing demand for refined security operations, Security Orchestration, Automation, and Response (SOAR) technologies have undergone rapid advancement. By leveraging intelligent orchestration capabilities in conjunction with core playbooks, SOAR facilitates both automated and semi-automated responses to security incidents. Nevertheless, the continuous evolution of network-attack techniques and the explosive growth of security alerts have rendered traditional static rule-based playbook matching and recommendation approaches increasingly inadequate in addressing the high frequency of alerts and the emergence of novel attack patterns. In this study, we propose an intelligent playbook recommendation algorithm for SOAR, developed under the paradigm of dynamic interest modeling. Specifically, the algorithm integrates a Transformer encoder, which captures long-term dynamic characteristics of alert signals in real time, with an LSTM network designed to extract short-term behavioral patterns. This hybrid architecture not only enables accurate playbook recommendations in high-volume alert scenarios, but also supports the reconstruction and optimization of playbooks, thereby offering valuable guidance for the mitigation of emerging threats. Experimental evaluations demonstrate that the proposed dynamic interest modeling-based algorithm exhibits high feasibility. It achieves improved performance in terms of both recommendation accuracy and efficiency, thus providing a robust technical foundation for enhancing the effectiveness of network security incident response and offering practical support for real-world security operations.