Security model

1. A computer-implemented method for a security model, comprising:

identifying a plurality of primary semantic relationships between a plurality of initial incident artifacts for a security domain based on a plurality of historical incidents;

identifying a plurality of parsed incident artifacts from a security encyclopedia based on the initial incident artifacts;

determining a plurality of secondary semantic relationships between the parsed incident artifacts based on a natural language processing of the security encyclopedia;

determining a plurality of influence directions corresponding to the secondary semantic relationships based on the secondary semantic relationships and the historical incidents; and

generating an influence network based on the initial incident artifacts, the primary semantic relationships, the historical incidents, the parsed incident artifacts, and the secondary semantic relationships.

2. The method of claim 1 , further comprising generating a historical security model based on the influence network and the influence directions.

3. The method of claim 2 , wherein the historical security model comprises a Bayesian network.

4. The method of claim 2 , further comprising querying the historical security model to determine an inference about the security domain and a potential security incident.

5. The method of claim 2 , further comprising querying the historical security model to determine an inference about the security domain and a zero-day attack.

6. The method of claim 2 , wherein generating the historical security model comprises determining a plurality of probability tables corresponding to the secondary semantic relationships based on the historical incidents.

7. The method of claim 6 , wherein the probability tables represent a probability that a first incident artifact influences a second incident artifact when associated by one of the secondary semantic relationships in association with a future security incident.

8. The method of claim 1 , further comprising updating the influence network based on an automatic parsing of the security encyclopedia.

9. A computer program product comprising program instructions stored on a computer readable storage medium, the program instructions executable by a processor to cause the processor to perform a method comprising:

identifying a plurality of primary semantic relationships between a plurality of initial incident artifacts for a security domain based on a plurality of historical incidents;

identifying a plurality of parsed incident artifacts from a security encyclopedia based on the initial incident artifacts;

determining a plurality of secondary semantic relationships between the parsed incident artifacts based on a natural language processing of the security encyclopedia;

determining a plurality of influence directions corresponding to the secondary semantic relationships based on the secondary semantic relationships and the historical incidents; and

generating an influence network based on the initial incident artifacts, the primary semantic relationships, the historical incidents, the parsed incident artifacts, and the secondary semantic relationships by determining a plurality of probability tables corresponding to the secondary semantic relationships based on the historical incidents.

10. The computer program product of claim 9 , the method further comprising generating a historical security model based on the influence network and the influence directions.

11. The computer program product of claim 10 , wherein the historical security model comprises a Bayesian network.

12. The computer program product of claim 10 , the method further comprising querying the historical security model to determine an inference about the security domain and a potential security incident.

13. The computer program product of claim 10 , the method further comprising querying the historical security model to determine an inference about the security domain and a zero-day attack.

14. The computer program product of claim 9 , the method further comprising updating the influence network based on an automatic parsing of the security encyclopedia.

15. The computer program product of claim 9 , wherein the probability tables represent a probability that a first incident artifact influences a second incident artifact when associated by one of the secondary semantic relationships in association with a future security incident.

16. A system comprising:

a computer processing circuit; and

a computer-readable storage medium storing instructions, which, when executed by the computer processing circuit, are configured to cause the computer processing circuit to perform a method comprising:

identifying a plurality of primary semantic relationships between a plurality of initial incident artifacts for a security domain based on a plurality of historical incidents;

identifying a plurality of parsed incident artifacts from a security encyclopedia based on the initial incident artifacts;

determining a plurality of secondary semantic relationships between the parsed incident artifacts based on a natural language processing of the security encyclopedia;

determining a plurality of influence directions corresponding to the secondary semantic relationships based on the secondary semantic relationships and the historical incidents;

generating an influence network based on the initial incident artifacts, the primary semantic relationships, the historical incidents, the parsed incident artifacts, and the secondary semantic relationships; and

generating a historical security model based on the influence network and the influence directions.

17. The system of claim 16 , wherein the historical security model comprises a Bayesian network.

18. The system of claim 16 , the method further comprising querying the historical security model to determine an inference about the security domain and a potential security incident.

19. The system of claim 16 , the method further comprising querying the historical security model to determine an inference about the security domain and a zero-day attack.

20. The system of claim 16 , the method further comprising updating the influence network based on an automatic parsing of the security encyclopedia.