Search

Security orchestration, automation, and response (SOAR) systems ingest alerts from security information and event management (SIEM) system, and then trigger relevant playbooks that automate and orchestrate the execution of a sequence of security activities. SOAR systems have two major limitations: (i) security analysts need to define, create and change playbooks manually, and (ii) the choice between multiple playbooks that could be triggered is based on rules defined by security analysts. To address these limitations, recent studies in the field of artificial intelligence for cybersecurity suggested the task of interactive playbook creation. In this paper, we propose IC-SECURE, an interactive playbook creation solution based on a novel deep learning-based approach that provides recommendations to security analysts during the playbook creation process. IC-SECURE captures the context in the form of alert data and current status of incomplete playbook, required to make reasonable recommendation for next module that should be included in the new playbook being created. We created three evaluation datasets, each of which involved a combination of a set of alert rules and a set of playbooks from a SOAR platform. We evaluated IC-SECURE under various settings, and compared our results with two state-of-the-art recommender system methods. In our evaluation IC-SECURE demonstrated superior performance compared to other methods by consistently recommending the correct security module, achieving precision@1 > 0.8 and recall@3 > 0.92

Model agnostic feature attribution algorithms (such as SHAP and LIME) are ubiquitous techniques for explaining the decisions of complex classification models, such as deep neural networks. However, since complex classification models produce superior performance when trained on low-level (or encoded) features, in many cases, the explanations generated by these algorithms are neither interpretable nor usable by humans. Methods proposed in recent studies that support the generation of human-interpretable explanations are impractical, because they require a fully invertible transformation function that maps the model's input features to the human-interpretable features. In this work, we introduce Latent SHAP, a black-box feature attribution framework that provides human-interpretable explanations, without the requirement for a fully invertible transformation function. We demonstrate Latent SHAP's effectiveness using (1) a controlled experiment where invertible transformation functions are available, which enables robust quantitative evaluation of our method, and (2) celebrity attractiveness classification (using the CelebA dataset) where invertible transformation functions are not available, which enables thorough qualitative evaluation of our method.

In this study, we propose an optimal assistive control strategy that uses estimated user's movement intention as the terminal cost function. We estimate the movement intention by observing human user's joint angle, angluar velocity, and muscle activities for very short period of time. A task-related low-dimensional feature space is extracted from the observed user's movement data. We assume that discrete number of optimal control laws associated to different target tasks are pre-computed. Then, the optimal assistive policy is derived by blending the pre-computed optimal control laws based on the linear Bellman combination method. Coefficients that determine how to blend the control laws are derived based on the low-dimensional feature value that represents the user's movement intention. To validate our proposed method, we conducted basketball throwing tasks. In these experiments, subjects were asked to throw a basketball into a hoop placed at different throwing distances. The distances from the throwing point to the hoop were estimated as the user's movement intention and the optimal control policies were derived by using our proposed method. The results showed that the basketball throwing performances of the subjects were mostly improved., Comment: 7 pages, 9 figures

With the help of M-theory configuration of N=1 supersymmetric QCD, we analyze the strong coupling moduli of N=1 theory and its relation with S-duality transformation in N=2 supersymmetric QCD. As a result we confirm that two type-IIA descriptions for N=1 supersymmetric QCD, one of them being strong coupling description and another being weak, correspond to a single M-theory description for N=1 supersymmetric QCD. The existence of singlet fields is also discussed., Comment: 11 pages, Latex, 4 figures, Changed content