Title: A CLIPS-Based Knowledge-Based Expert System for Cybersecurity Incident Diagnosis and Response
Authors: Muhammad Isleem, Taha Al-Jaro, Samy S. Abu-Naser
Volume: 10
Issue: 7
Pages: 38-48
Publication Date: 2026/07/28
Abstract:
Cybersecurity incident triage requires analysts to combine heterogeneous evidence from endpoint, network, identity, email, and application sources under severe time pressure. This paper presents the design and implementation of a knowledge-based expert system that supports the diagnosis of common cybersecurity incidents and recommends immediate response actions. The prototype is implemented in CLIPS using production rules, structured facts, candidate scoring, conflict resolution, and an explanation-oriented output. Its knowledge base covers eight incident classes: ransomware, phishing compromise, brute-force attack, distributed denial-of-service, malware infection, data exfiltration, insider threat, and web application attack. Indicators are represented as facts, while rules infer one or more candidate incidents. A final rule selects the highest-scoring candidate and returns the incident type, severity, supporting evidence, and a prioritized response recommendation. The implementation contains 19 production rules and was evaluated through 12 controlled scenarios, including complete, partial, competing, and insufficient-evidence cases. The system produced the expected result in 12 of 12 scenarios. Across 360 repeated timing runs, mean inference time was 0.036 ms and maximum inference time was 0.119 ms in the test environment. These results demonstrate functional correctness and very low rule-engine overhead for the designed cases, while the study also emphasizes that the evaluation is a prototype verification rather than a real-world accuracy benchmark. The proposed system illustrates how transparent, maintainable, and auditable rule-based reasoning can complement security analysts and provide explainable decision support during early incident triage.