Automated Incident Response Using AI-Based Decision Trees

Abstract

The emergence of high-level cyber threats, including polymorphic ransomware and APTs, needs quicker and more effective intrusion response capabilities in the field of cybersecurity. Manual systems are also traditionally slow, with a median response time of 15-30 minutes, making organizations prone to fast attacks. This study examines the application of AI-based decision tree implementation to validate the effectiveness of decision trees in automating incident classification, prioritization, and response. The research seeks to increase the speed and accuracy of incident detection and analysis through a machine learning model, such as Classification and Regression Trees (CART), in cutting the time to respond (MTTR) by at least 40% and achieving more than 95% detection rates of typical threats such as phishing and malware. The process involves training decision trees on features such as IP reputation, domain flux, and attempted failed logins, and then adding these models to existing incident response mechanisms, including SIEM and SOAR. The findings indicate that there is a substantial decrease in the time taken to respond (40-60%), and false positives are reduced by 15-25% relative to an ordinary system. The automation also decreased manual interaction by 80%, enhancing efficiency among analysts. The study explains how AI decision trees can be used to optimize the incident response process because of operational advantages, such as reducing costs and improving the security posture. Future studies should be directed to the further development of the model to be able to cope with more intricate threats and also to ensure that automated systems are ethical and transparent in their decision-making.