## 3 Proposed Method
### CBR Process
#### 3.2.2 Case Retrieval  
The purpose of this study was to develop a system that finds the previous APT cases that are the most similar to the current APT case. In this study, we used Jaccard similarity as a basic baseline metric to measure the similarity between the current problem and previous cases. Jaccard similarity is a method for measuring the similarity of two objects. The similarity between the two sets is defined as the ratio of the intersection to the union, as follows. \[\text{J}(\text{A},\text{ B})=\frac{|\text{A}\cap\text{B}|}{|\text{A}\cup\text{B}|}= \frac{|\text{A}\cap\text{B}|}{|\text{A}|+|\text{B}|-|\text{A}\cap\text{B}|} \tag{1}\]  
Using Jaccard similarity, the overall similarity of the software and techniques in the previous case and current problem is calculated and represented as a value between 0 and 1. Equation (2) is used to calculate the case-to-case similarity measure, which is represented \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Category** & **Input** & **Process** & **Artefact** \\ \hline \multirow{2}{*}{Scenario preprocessing} & Scenario & Scenario analysis & Attack template \\  & Attack template & Attack analysis & Attack component \\ \multirow{2}{*}{Case retrieval} & Attack component & Similarity metric & Similar attack candidates \\ \multirow{2}{*}{Case reuse} & Similar attack candidates & Reuse solution & Security requirements \\  & Attack component Similar attack & & \\  & candidates Security requirements & & \\ \multirow{2}{*}{Case revision} & Security expert information & & \\  & Security expert information & Security & \\ \multirow{2}{*}{Case retention} & Attack component Revised or new & & \\  & security requirements & Storage of the solved problem & Improved CB-PDO \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Artefacts of each process. as the sum of the matching software and skill sets, where C represents the current problem and C\({}_{n}^{\prime}\) represents the nth previous case. \[\mathrm{J(C,C_{n}^{\prime})=J(C_{SW},C_{n_{sw}}^{\prime})+J(C_{Tech},C_{n_{Tech}}^ {\prime})} \tag{2}\]  
However, ontology includes numerous characteristics that can represent the characteristics of an APT in addition to the software and technologies used by the threat group. Therefore, we propose a method to measure the similarity between techniques by considering the similarity of the characteristics in addition to Jaccard similarity, which simply considers whether the same elements are used. To measure similar elements, we compared the class of elements in the ontology or the relationship between instances belonging to that class. We defined weights for computing the APT features and reflect them in the similarity measurements. The questions that can be selected to measure the similarity between technique instances stored in an ontology are as follows:  
* Do the two elements have a parent-child/sibling relationship? * Can two elements be performed on the same platform? * Do the two elements use the same tactics? * Are the attack patterns utilized by the two elements the same? * Were the two elements performed in the same attack stage (in the cyber-kill chain)? The answers to each of these five questions have an equal initial weight, and hence, 0.2 is assigned to each satisfied condition. If all are satisfied, the total is 1. To assign weights between the current problem C and past case C\({}_{n}^{\prime}\), the weights for features satisfying the conditions are calculated by formulating the problem for the two cases as a matrix, as shown in Figure 5. The size of the matrix is the number of techniques performed in C \(\times\) the number of techniques performed in C\({}_{n}^{\prime}\). Equation (3) shows that, according to the rule, 0.2 or 0 is assigned to conditions that are satisfied. \[\mathrm{sim}(t,t^{\prime})\bigg{\{} \begin{aligned} & 0.2\text{ (satisfied with the rule)}\\ & 0\text{ (not satisfied with the rule)}\end{aligned}  \tag{3}\]  
Equation (4) represents the overall average of the weight matrix.