# PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation
## 5 Data Modelling
### Remediation Policy  
Remediation policies can be designed intuitively as flow charts (Figure 5) using a graphical interface. In order to be executed by IR, these are transformed and stored as Unified Modelling Language (UML) files. Using the UML methodology, we ensure unified design, clean structure, and portability in order to easily include the created remediation policy in the IR instances. The FSM approach allows the creation of personalised and highly flexible remediation, which is deterministic. The outcomes are predictable and easily verifiable. Namely, the remediation steps are limited to a finite set of possible paths and states. Although being simple to comprehend and put into practice, an FSM is frequently disregarded.  
Despite significant advances in security enforcement, attackers are still able to compromise organisations' computing resources [55], explained by the increasing management complexity handled by security teams [56]. In our approach, the FSMs open the opportunity to formalise and personalise the policy decisions related to user behaviour, organisational systems, and data in all access contexts. A policy is automatically exported and integrated into the IR, where it waits for activation by an outside trigger, i.e., the definition of a newly detected cyber threat. Figure 5 showcases two FSMs designed to trigger personalised remediation actions for use case 1 (e-health in the medical practice) and use case 2 (e-commerce). As outlined in Section 3, the context of the two use cases is slightly different. Namely, in the case of a small medical practice using an e-health solution, we assume a fully local infrastructure with one server being used for the practice (i.e., storage and operation). In e-commerce, however, the operational context is distributed across a cloud environment (delivering services, including storage) and local devices (PCs using such services). Furthermore, in medical practice, the end-users are doctors and nurses or administrators, whereas in e-commerce, the end-users are employees and citizens. Finally, the priority related to data protection and the operational environment is also different. Namely, for e-commerce, the continuity of the service drives the revenue generation and is as important as preserving the data. Thus, a complete shutdown of systems is only a last resort.  
The definition of the states for the FSM is outlined in Figure 5, which provides two examples on how policies are aligned with the operational context of a business and its priorities, even when the same attack occurs, i.e., as applied to ransomware events. The above examples illustrate policies for the two presented use cases, where both the e-health and e-commerce scenarios feature frequent backups, remediation actions, threat sharing, and notification of the end-user. In the case of e-commerce, remediation differs to reflect the operational context. Namely, the cloud hosting instance is isolated and services are mirrored with the last backup. All devices within the business's network are also actively monitored to evaluate the ransomware spread and prevent further damage.  
The showcased FSM models are automatically transformed into UML representations after they are saved. The generated UML model can be directly used to initialise the IR and is executed on a specific trigger in the PALANTIR platform.