# Improving Incident Response in Big Data Ecosystems by Using Blockchain Technologies
## 6 Conclusions and Future Work  
A big data ecosystem is usually a very complex environment, therefore, to try to manage its operation it is advisable to have a process based on the main best practices in the industry and that is sufficiently abstract to be applicable to any scenario. Hence, the main contribution of this paper is the definition of an incident response process that is specific to big data ecosystems. This process consists of five different phases which in turn are divided into different activities with inputs and outputs. For the implementation of the process, we propose the use of blockchain technology; this allows the improvement of the security of the data stored by increasing its immutability and traceability. Thanks to these characteristics, the records stored can be used as forensic evidence. In addition, these stored records can be analyzed through the use of different machine learning models. This analysis aims to discover different attack patterns, aiming to achieve early detection and prediction of security incidents.  
This research is part of a long research project, since it is supported by an SRA that acts as a metamodel of the different components that normally make up a big data ecosystem. In addition, this process integrates and evolves our proposal for the development process of secure big data ecosystems.  
In this paper, and as a first step in the validation of our proposal, we include a case study on a CPS system, which is automated by a big data ecosystem based on Apache Spark. This system has been connected to a private blockchain network, implemented by Hyperledger Fabric, that stores all the events that occur in the system for later analysis through a machine learning process.  
This case study is still in a stage of development, so as future work, we aim to implement the machine learning process that we present, as well as test the system by performing different attack scenario on the system. These attacks will be stored along with the data generated by the big data ecosystem for later analysis. After several iterations we expect to obtain the optimal parameterization of the algorithms. Moreover, it would be necessary to verify the computational cost increase involved in adding a blockchain system and its scalability in larger projects. In addition, the process will continue to be validated through its application in different big data and attack scenarios. Finally, we are considering creating a process to manage the end-of-life of a big data ecosystem.  
Conceptualization, J.M. and E.B.F.; methodology, M.A.S.; validation, M.A.S. and E.F.-M.; formal analysis, J.M.; investigation, J.M.; writing--original draft preparation, J.M.; supervision, M.A.S., E.F.-M. and E.B.F.; project administration, M.A.S. and E.F.-M.; funding acquisition, E.F.-M. All authors have read and agreed to the published version of the manuscript.  
This work was funded by the ECLIPSE project (RTI2018-094283-B-C31 funded by \"Ministerio de Economia y Competitividad and the Fondo Europeo de Desarrollo Regional FEDER\") and the GENESIS project (SBPLY-17-180501-00020 funded by \"Consejeria de Educacion, Cultura y Deportes de la Direccion General de Universidades, Investigacion e Innovacion de la JCM\") and the Programa Operativo Regional FEDER 2014/2020.  
The authors declare no conflicts of interest.