Cognitive cyber security assistants - Computationally deriving cyber intelligence and course of actions

Abstract

Cyber security organizations charged with protecting IT infrastructures face daunting complex challenges. These include a vast array of information sources of variable trustworthiness, overwhelming numbers of incident reports, quickly changing offensive and defensive tactics, and the ongoing shortage of skilled cybersecurity personnel. Cognitive systems offer a new approach to addressing these challenges. Using natural language processing and machine learning techniques, systems such as IBM Watson" can incorporate an enormous amount of information each day, discover the entities and relationships described, and apply reasoning over that knowledge to understand questions from the Security Analyst and provide answers in their own language. In this paper we discuss the technologies and techniques we used to build a cognitive cyber security assistant.