# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 1 Introduction
This is related to the concept of forensic readiness, which seeks not only to handle the incidents, but also to anticipate them and minimize the costs of investigating their causes. Hence, forensic readiness is usually defined as the ability of an organization to collect, preserve, protect and analyze digital evidence which can be used effectively in any legal matter [12]. In this paper, we propose a process to cover the secure operation of the big data ecosystem. In a nutshell, we deal with how to implement an incident response strategy for this kind of environments. This process will be defined by means of different phases and activities. Moreover, we include a guide for the implementation of this process based on blockchain technologies. Usually, blockchain technologies are defined depending on the purpose they perform. The most common functions include cryptocurrencies, smart contracts, and distributed ledger systems between businesses [13]. To tackle the security challenges stated above, we propose to use blockchain as a distributed ledger to maintain the data needed to address security issues, including all operations performed on data stored in big data, together with the different alerts and warnings produced by the big data ecosystem. The use of blockchain brings some advantages, including immutability and increased data traceability, although it comes at a cost of greater technical complexity. The use of the blockchain technology supposes an evolution with respect to the relational databases in certain aspects; such as that with blockchain the system does not have a single point of failure, which implies, that in case a participant node makes an incorrect change it will be immediately corrected by the other nodes. This function increases the trust of the data stored in the blockchain system so that it can be used as audit-proof evidence in a legal process [14]. It should also be highlighted that the use of machine learning techniques has proved to be a very useful tool when it comes to identifying security problems [14]. The storage of the different security events that happen in the system can thus be leveraged by implementing an intelligent system that studies both the causes of the event and possible solutions to it. Moreover, the analysis of data from previous events can help predict security incidents before they occur, thereby reducing the impact on the big data ecosystem. In an effort to facilitate understanding of our proposal, the paper also presents an example of the application of our secure operation process for big data. This case study is based on the design and implementation of a hydroponic crop that has different automated sensors and actuators, thanks to a big data ecosystem (cyber-physical system). This big data environment is connected to a private blockchain network, implemented by Hyperledger Fabric, which aims to store all the events produced by the actuators for later analysis through machine learning techniques, such as PCA (Principal Component Analysis) or neural networks. This analysis enables security incidents to be studied, the aim being to make them easier to predict or detect at an earlier stage. This case study can be considered as the first step in the validation of our proposal. In this paper we present our proposal for a process to manage the response to incidents in big data ecosystems. This process is an evolution of our proposals for a security reference architecture [15] for big data and a process for the analysis, design and implementation of this type of ecosystem [9]. The main contributions of our paper are therefore: (I) the creation of an abstract incident response process for big data ecosystems, (II) its integration with a general process of creation and implementation of secure big data, (III) a technological proposal to support forensic readiness through the use of blockchain and machine learning technologies, and (IV) a case study, which shows the application of our proposal in a cyber-physical environment.