# A Study on a Scenario-Based Security Incident Prediction System for Cybersecurity
## 5 Limitations of the Reactive Approach to Existing Threats  
An analysis of existing security incident response methods reveals that traditional approaches predominantly rely on reactive measures that address threats only after they have occurred. These approaches are primarily based on signature-based detection and heuristic techniques, which are inherently limited in predicting and mitigating new or advanced threats [22]. Consequently, this reactive nature hinders proactive prevention and rapid response, increasing the overall vulnerability of systems to emerging cyberattacks. Current security frameworks fail to fully integrate scientific research and proactive strategies, creating structural limitations in predicting and addressing future threats. For example, systems such as Security Information and Event Management (SIEM) and Enterprise Security Management (ESM) focus on collecting and correlating security events and logs within organizations. However, their effectiveness is constrained by heavy reliance on manual analysis by security personnel, which limits scalability and accuracy in forecasting and categorizing potential incidents [23]. This dependency undermines the ability to analyze advanced threats effectively and hampers timely and systematic responses to novel attack vectors. Integrating advanced threat modeling frameworks, such as the MITRE ATT&CK framework, could address these limitations by enhancing predictive capabilities and streamlining incident response processes. As illustrated in Figure 3, the existing proxy-based relay server log collection method highlights inefficiencies in categorizing and processing raw data. Although distributed log collection provides scalability, it lacks the technical capacity to proactively analyze \begin{table}
\begin{tabular}{c c} \hline \hline
**Layer** & **Description** \\ \hline \multirow{4}{*}{Operating System} & Data leakage due to missed security updates and antivirus program updates \\  & Important file leakage due to poor management of shared folders \\  & Leakage of important corporate data through P2P, messenger, etc. \\  & System intrusion due to lack of access control service \\ \hline \multirow{4}{*}{Web Service} & Personal information exposure due to database system vulnerabilities \\  & Database access credentials leaked due to weak password settings \\  & Personal information leakage caused by SQL injection attacks \\ \cline{1-1}  & Administrator privileges exposed due to poor configuration of web page access control \\ \cline{1-1}  & Rights exposed due to Cross-Site Scripting (XSS) vulnerabilities \\ \cline{1-1}  & System information leakage due to vulnerabilities in file transmission \\ \hline \multirow{4}{*}{Network System} & Personal information and passwords leaked due to the lack of SSL encryption \\ \cline{1-1}  & Risk of direct network system attacks due to poor network configuration \\ \cline{1-1}  & Important corporate information leakage through wireless networks \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Definition of internal and external security incident types. \begin{table}
\begin{tabular}{c c} \hline \hline
**Layer** & **Description** \\ \hline Security Incident Type Analysis & Major Category: Internal, External \\  & Subcategory: Hacking, Malware, Data Leakage, etc. \\  & Minor Category: Email, Web, System, Network, Storage, Print, etc. \\ \hline \multirow{4}{*}{Security Incident Target Protection} & Major Category: System, Network, Human, Process \\  & Subcategory: PC, Server, IoT Devices, Smart Devices, Organization \\ \cline{1-1}  & Chart, Access Control, etc. \\ \hline Security Incident Target Information Input & Manual Input: IP range, system asset information, permission \\  & information, account information, organization chart, etc. \\  & Automated Collection: Information collected via IP scans, etc. \\ \hline \end{tabular}
\end{table} 
Table 3: Information input structure for security incident targets, types, and input methods for customized corporate services.