This paper presents an approach to the automatic remediation of threats reported by Cyber Threat Intelligence. Remediation strategies, named Recipes, are expressed in a close-to-natural language for easy validation. Thanks to the developed models, they are interpreted, contextualized, and then translated into CACAO Security playbooks, a standard format ready for automatic enforcement, without human intervention. The presented approach also allows sharing of remediation procedures on threat-sharing platforms (e.g. MISP) which improves the overall security posture. The effectiveness of the approach has been tested in the context of two EC-funded projects.

Author/s
Settanni, F., Regano, L., Basile, C., & Lioy, A. (2023, June). A Model for Automated Cybersecurity Threat Remediation and Sharing. In 2023 IEEE 9th International Conference on Network Softwarization (NetSoft) (pp. 492-497). IEEE.