A Hybrid Recommender System for Cybersecurity Based on a Rating Approach

The main function of a security analyst is to protect and make the best decisions for preserving the integrity of computer systems within an organization. To provide a quick response, the analyst usually depends on his good judgement, which should lead him to execute manual processes in a limited time. By dealing with too many anomalies, responses are only provided to those threats with the highest level of criticality. This research aims to propose a tool for helping analysts to filter out anomalies and latent risks. To meet this objective, a recommendation system based on collaborative filtering and knowledge was developed, generating ratings of the worst cases with the best available recommendations based on expert judgement. During tests, the system allowed an improvement in the response time from analysts to solve problems. It also eliminated subjectivity and reduced the number of manual processes.