Security model

A computer program product comprising program instructions stored on a computer readable storage medium, the program instructions executable by a processor to cause the processor to perform a method comprising:

• identifying a plurality of primary semantic relationships between a plurality of initial incident artifacts for a security domain based on a plurality of historical incidents;
• identifying a plurality of parsed incident artifacts from a security encyclopedia based on the initial incident artifacts;
• determining a plurality of secondary semantic relationships between the parsed incident artifacts based on a natural language processing of the security encyclopedia;
• determining a plurality of influence directions corresponding to the secondary semantic relationships based on the secondary semantic relationships and the historical incidents;
• and
• generating an influence network based on the initial incident artifacts, the primary semantic relationships, the historical incidents, the parsed incident artifacts, and the secondary semantic relationships by determining a plurality of probability tables corresponding to the secondary semantic relationships based on the historical incidents.

A system comprising:

• a computer processing circuit;
• and
• a computer-readable storage medium storing instructions, which, when executed by the computer processing circuit, are configured to cause the computer processing circuit to perform a method comprising:
• identifying a plurality of primary semantic relationships between a plurality of initial incident artifacts for a security domain based on a plurality of historical incidents;
• identifying a plurality of parsed incident artifacts from a security encyclopedia based on the initial incident artifacts;
• determining a plurality of secondary semantic relationships between the parsed incident artifacts based on a natural language processing of the security encyclopedia;
• determining a plurality of influence directions corresponding to the secondary semantic relationships based on the secondary semantic relationships and the historical incidents;
• generating an influence network based on the initial incident artifacts, the primary semantic relationships, the historical incidents, the parsed incident artifacts, and the secondary semantic relationships;
• and
• generating a historical security model based on the influence network and the influence directions.