Incorporating Taxonomies of Cyber Incidents Into Detection Networks for Improved Detection Performance
Fuente:
arXiv
Gespeichert in:
| 1. Verfasser: | |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2025
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866912537314852864 |
|---|---|
| author | Warnick, Ryan |
| author_facet | Warnick, Ryan |
| contents | Many taxonomies exist to organize cybercrime incidents into ontological categories. We examine some of the taxonomies introduced in the literature; providing a framework, and analysis, of how best to leverage different taxonomy structures to optimize performance of detections targeting various types of threat-actor behaviors under the umbrella of precision and recall. Networks of detections are studied, and results are outlined showing properties of networks of interconnected detections. Some illustrations are provided to show how the construction of sets of detections to prevent broader types of attacks is limited by trade-offs in precision and recall under constraints. An equilibrium result is proven and validated on simulations, illustrating the existence of an optimal detection design strategy in this framework. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2508_10187 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Incorporating Taxonomies of Cyber Incidents Into Detection Networks for Improved Detection Performance Warnick, Ryan Methodology Cryptography and Security Optimization and Control Probability Statistics Theory 14J60, 14J62 Many taxonomies exist to organize cybercrime incidents into ontological categories. We examine some of the taxonomies introduced in the literature; providing a framework, and analysis, of how best to leverage different taxonomy structures to optimize performance of detections targeting various types of threat-actor behaviors under the umbrella of precision and recall. Networks of detections are studied, and results are outlined showing properties of networks of interconnected detections. Some illustrations are provided to show how the construction of sets of detections to prevent broader types of attacks is limited by trade-offs in precision and recall under constraints. An equilibrium result is proven and validated on simulations, illustrating the existence of an optimal detection design strategy in this framework. |
| title | Incorporating Taxonomies of Cyber Incidents Into Detection Networks for Improved Detection Performance |
| topic | Methodology Cryptography and Security Optimization and Control Probability Statistics Theory 14J60, 14J62 |
| url | https://arxiv.org/abs/2508.10187 |