Making security recommendations

A computer program product comprising program instructions stored on one or more computer readable storage media, the program instructions executable by one or more computer processors to cause the computer processors to perform a method comprising:

• determining a plurality of recommended actions based on a security incident using an action model trained to make recommendations;
• determining a plurality of similar targets to a target of the security incident using a collaborative filtering model trained to assign a confidence value of similarity between two targets;
• assigning a plurality of weights to the recommended actions based on:
• one or more actions taken by the similar targets and the confidence value;
• and
• a success or failure of the recommended actions;
• and
• generating a prioritized list of the recommended actions that is sorted based on the assigned weights.

A system comprising:

• one or more computer processing circuits;
• and
• one or more computer-readable storage media storing instructions, which, when executed by the one or more computer processing circuits, are configured to cause the one or more computer processing circuits to perform a method comprising:
• determining a plurality of recommended actions based on a security incident using an action model trained to make recommendations;
• determining a plurality of similar targets to a target of the security incident using a collaborative filtering model trained to assign a confidence value of similarity between two targets;
• assigning a plurality of weights to the recommended actions based on:
• one or more actions taken by the similar targets and the confidence value;
• and
• a success or failure of the recommended actions;
• and
• generating a prioritized list of the recommended actions that is sorted based on the assigned weights.

A computer-implemented method, comprising:

• determining a plurality of recommended actions based on a security incident using an action model trained to make recommendations;
• determining a plurality of similar targets to a target of the security incident using a collaborative filtering model trained to assign a confidence value of similarity between two targets;
• assigning a plurality of weights to the recommended actions based on:
• one or more actions taken by the similar targets and the confidence value;
• a success or failure of the recommended actions;
• and
• a timing of the security incident and a timing of the recommended actions;
• and
• generating a prioritized list of the recommended actions that is sorted based on the assigned weights, wherein the prioritized list of recommended actions comprises a success rate of one or more of the recommended actions.

A computer program product comprising program instructions stored on one or more computer readable storage media, the program instructions executable by one or more computer processors to cause the computer processors to perform a method comprising:

• determining a plurality of recommended actions based on a security incident using an action model trained to make recommendations;
• determining a plurality of similar targets to a target of the security incident using a collaborative filtering model trained to assign a confidence value of similarity between two targets;
• assigning a plurality of weights to the recommended actions based on:
• one or more actions taken by the similar targets and the confidence value;
• a success or failure of the recommended actions;
• and
• a timing of the security incident and a timing of the recommended actions;
• and
• generating a prioritized list of the recommended actions that is sorted based on the assigned weights, wherein the prioritized list of recommended actions comprises a success rate of one or more of the recommended actions.