{"id":"https://openalex.org/W4400976290","doi":"https://doi.org/10.1145/3664476.3670450","title":"AI4SOAR: A Security Intelligence Tool for Automated Incident Response","display_name":"AI4SOAR: A Security Intelligence Tool for Automated Incident Response","publication_year":2024,"publication_date":"2024-07-25","ids":{"openalex":"https://openalex.org/W4400976290","doi":"https://doi.org/10.1145/3664476.3670450"},"language":"en","primary_location":{"id":"doi:10.1145/3664476.3670450","doi":"https://doi.org/10.1145/3664476.3670450","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3664476.3670450","pdf_url":null,"source":{"id":"https://openalex.org/S4363608926","display_name":"International Conference on Availability, Reliability and Security (ARES)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5021986995","display_name":"Manh-Dung Nguyen","orcid":"https://orcid.org/0000-0001-8760-3258","observed_orcids":["https://orcid.org/0000-0001-8760-3258"]},"institutions":[{"id":"https://openalex.org/I4210118939","display_name":"Montimage (France)","ror":"https://ror.org/02a8qtz61","country_code":"FR","type":"company","lineage":["https://openalex.org/I4210118939"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Manh-Dung Nguyen","raw_affiliation_strings":["Montimage EURL, France"],"raw_orcid":"https://orcid.org/0000-0001-8760-3258","affiliations":[{"raw_affiliation_string":"Montimage EURL, France","institution_ids":["https://openalex.org/I4210118939"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084443011","display_name":"Wissam Mallouli","orcid":"https://orcid.org/0000-0003-2548-6628","observed_orcids":["https://orcid.org/0000-0003-2548-6628"]},"institutions":[{"id":"https://openalex.org/I4210118939","display_name":"Montimage (France)","ror":"https://ror.org/02a8qtz61","country_code":"FR","type":"company","lineage":["https://openalex.org/I4210118939"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Wissam Mallouli","raw_affiliation_strings":["Montimage EURL, France"],"raw_orcid":"https://orcid.org/0000-0003-2548-6628","affiliations":[{"raw_affiliation_string":"Montimage EURL, France","institution_ids":["https://openalex.org/I4210118939"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072274443","display_name":"Ana Rosa Cavalli","orcid":"https://orcid.org/0000-0003-2586-9071","observed_orcids":["https://orcid.org/0000-0003-2586-9071"]},"institutions":[{"id":"https://openalex.org/I4210118939","display_name":"Montimage (France)","ror":"https://ror.org/02a8qtz61","country_code":"FR","type":"company","lineage":["https://openalex.org/I4210118939"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Ana Rosa Cavalli","raw_affiliation_strings":["Montimage EURL, France"],"raw_orcid":"https://orcid.org/0000-0003-2586-9071","affiliations":[{"raw_affiliation_string":"Montimage EURL, France","institution_ids":["https://openalex.org/I4210118939"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5083963581","display_name":"Edgardo Montes de","orcid":"https://orcid.org/0000-0001-6771-0689","observed_orcids":["https://orcid.org/0000-0001-6771-0689"]},"institutions":[{"id":"https://openalex.org/I4210118939","display_name":"Montimage (France)","ror":"https://ror.org/02a8qtz61","country_code":"FR","type":"company","lineage":["https://openalex.org/I4210118939"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Edgardo Montes de Oca","raw_affiliation_strings":["Montimage EURL, France"],"raw_orcid":"https://orcid.org/0000-0001-6771-0689","affiliations":[{"raw_affiliation_string":"Montimage EURL, France","institution_ids":["https://openalex.org/I4210118939"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210118939"],"apc_list":null,"apc_paid":null,"fwci":4.6769,"has_fulltext":false,"cited_by_count":15,"citation_normalized_percentile":{"value":0.96085616,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0020000000949949026,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/incident-response-automation","display_name":"automated incident response","score":0.8730000257492065},{"id":"https://openalex.org/keywords/security-operations-center","display_name":"security operations center","score":0.5979999899864197},{"id":"https://openalex.org/keywords/security-intelligence","display_name":"security intelligence","score":0.6930000185966492},{"id":"https://openalex.org/keywords/similarity-learning","display_name":"similarity learning","score":0.9610000252723694},{"id":"https://openalex.org/keywords/ssh-brute-force-attacks","display_name":"SSH brute-force attacks","score":0.777999997138977},{"id":"https://openalex.org/keywords/shuffle","display_name":"shuffle","score":0.5809999704360962}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.713221549987793},{"id":"https://openalex.org/C2985105721","wikidata":"https://www.wikidata.org/wiki/Q13479512","display_name":"Incident response","level":2,"score":0.4630885720252991},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3966333568096161}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3664476.3670450","doi":"https://doi.org/10.1145/3664476.3670450","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3664476.3670450","pdf_url":null,"source":{"id":"https://openalex.org/S4363608926","display_name":"International Conference on Availability, Reliability and Security (ARES)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W3194310778","https://openalex.org/W4220837030","https://openalex.org/W4292158626","https://openalex.org/W4360841606","https://openalex.org/W4376606841","https://openalex.org/W4388514594"],"related_works":["https://openalex.org/W7171790781","https://openalex.org/W7155844212","https://openalex.org/W7201965267","https://openalex.org/W7166076910","https://openalex.org/W7216775719","https://openalex.org/W7089236875","https://openalex.org/W7160473709","https://openalex.org/W7171054754","https://openalex.org/W6930833359","https://openalex.org/W7167918121"],"abstract_inverted_index":{"The":[0],"cybersecurity":[1],"landscape":[2],"is":[3],"fraught":[4],"with":[5,65],"challenges":[6,45],"stemming":[7],"from":[8],"the":[9,66],"increasing":[10],"volume":[11],"and":[12,25,35,62,84,104],"complexity":[13],"of":[14,76],"security":[15,37,50],"alerts.":[16,100],"Traditional":[17],"manual":[18],"or":[19],"semi-automated":[20],"approaches":[21],"to":[22,93],"threat":[23],"analysis":[24],"incident":[26,55,114],"response":[27,115],"often":[28],"result":[29],"in":[30,33],"significant":[31],"delays":[32],"identifying":[34],"mitigating":[36],"threats.":[38],"In":[39],"this":[40],"paper,":[41],"we":[42,87],"address":[43],"these":[44],"by":[46],"proposing":[47],"AI4SOAR,":[48],"a":[49,73,89,109],"intelligence":[51],"tool":[52],"for":[53,98,112],"automated":[54,113],"response.":[56],"AI4SOAR":[57,103],"leverages":[58],"similarity":[59],"learning":[60,91],"techniques":[61],"integrates":[63],"seamlessly":[64],"open-source":[67,78],"SOAR":[68,79],"platform":[69],"Shuffle.":[70],"We":[71,101],"conduct":[72],"comprehensive":[74],"survey":[75],"existing":[77],"platforms,":[80],"highlighting":[81],"their":[82],"strengths":[83],"weaknesses.":[85],"Additionally,":[86],"present":[88],"similarity-based":[90],"approach":[92],"quickly":[94],"identify":[95],"suitable":[96],"playbooks":[97],"incoming":[99],"implement":[102],"demonstrate":[105],"its":[106],"application":[107],"through":[108],"use":[110],"case":[111],"against":[116],"SSH":[117],"brute-force":[118],"attacks.":[119]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":5}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2024-07-26T00:00:00"}