Markov based decision support for cost-optimal response in security management

In this contribution, we introduce a prototype of a decision support tool for cost-optimal response in security management. The threat situation of a closed infrastructure, exposed to multiple threats, and the corresponding response actions are modeled by a continuous-time Markov decision process (CMDP). Since the CMDP cannot be solved exactly for large infrastructures, the response actions are determined from a heuristic, based on an index rule. The decision support tool's user interface displays the infrastructure's current threat state and proposes the heuristic response actions to the decision maker. In this way, global situation awareness can be enhanced and the decision maker is able to initiate an almost cost-optimal response action in short time.