{'fraction_non_alphanumeric': 0.013524936601859678, 'fraction_numerical': 0.0016906170752324597, 'mean_word_length': 5.297872340425532, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Constructing a Complete Timeline of a Security Incident by Aggregating Reports

Security incidents are a significant threat to information system management. Significant attacks are caused by malware, DDoS, intrusion using vulnerabilities, and the line. Attack reports are one kind of resource used to describe the details of attack trends such as what kinds of techniques are used to successfully break into information systems. Although many security reports are published after a huge security incident, for such information to be useful to nontechnical organizations, the information has to be to aggregated from public organizations, vendors, and researchers. We propose a method of making a timeline that aggregates published security reports to identify the course of a particular security incident. In order to evaluate the effectiveness of our approach, we apply our method to the WannaCry incident using 19 reports covering essential events. The resultsshow that our method allows a user to identify the relationship between an essential event and the release timing of a related report, making it easy to grasp the whole of security incident flow of the WannaCry timeline.