# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 4 Incident Response for Big Data Ecosystems
### Identification and Analysis
This first blockchain system should store all the data related to the actions performed on the data, i.e., the typical big data services: collection, preparation, analysis, visualization and access control to the data. Each block of this system should have a similar structure: ID, user ID (the user that performed the operation), role of the user, timestamp, type of \begin{table}
\begin{tabular}{p{71.1 pt} p{71.1 pt} p{71.1 pt} p{71.1 pt}} \hline \hline
**Activities** & **Description** & **Inputs** & **Outputs** \\ \hline Incident analysis & Detection and analysis of possible incidents that may occur in the environment & List of sources for indicators Documentation from previous casesBlockchain systems & Incident information \\ \hline Incident prioritization & Prioritize incidents to determine necessary recovery actions & Incident Documentation from previous cases & Incident information updated \\ \hline Incident communication & Communication of the incident to the necessary stakeholders & Incident information Communication plan & Stakeholder reported about the problem \\ \hline Blockchain storage & Store all evidence related to the incident in the incident blockchain system. Prior to this, events that occurred in the big data ecosystem must be stored in the event blockchain & List of sources for indicators Incident information updated & New block in the incident blockchain blockchain \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Activities of Phase 3: identification and analysis. operation performed, and the data affected by the operation. Each operation has its own characteristics that must be taken into account, however; for example, the collection can also store the information about the data source from which the data is being stored in the big data, or the visualization should consider that it is possible to infer sensitive information from anonymized data by performing a large number of queries on the same dataset. Figure 4 shows a UML (Unified Modeling Language) diagram with a possible implementation of the event blockchain, displaying how it is connected to the big data ecosystem. As it can be seen in the figure, each blockchain system is composed of a set of blocks and operations. In turn, each block contains the information of an operation performed on the data. In parallel, a second blockchain system stores all the data related to the incidents already identified (incident blockchain), and order to do that, this blockchain is connected to a component that monitors the compliance of the requirements of the big data ecosystem. This means that when an incident occurs it is detected and stored in the incident blockchain. It is, however, necessary to store more incident data that could help in the recovery of the system. To that end, when an incident is identified, all event data that may be related to it will be copied to this second system by using a proxy between both blockchain systems. Once all the data are collected in the blockchain systems, it is time to carry out the analysis of them. This implies the need to implement an intelligent system that employs machine learning techniques to obtain value from these data, to identify the reasons why the incident happened, for example, or to try to predict the occurrence of a new incident by analyzing the events that happen in real time. Moreover, all this data should be visualized by means of a dashboard that is checked by the incident response team. Figure 5 depicts the interaction between the big data ecosystem and the blockchain systems. This figure shows a summarized version of the different components of the SRA for big data ecosystems defined in [15]. As explained previously, this activity is not carried out sequentially, but rather in parallel to the rest of the activities of this phase. Figure 4: Interaction between big data ecosystems and blockchain systems.