A New Complex Incident Response Plan Decision-Making Model

Taking the botnet incident response plan decision-making as an example, we construct a new model by using action decomposition. In this model we introduce action layer, relation between sub-actions and decompose the complex incident response plan into many layers. This model provides a graphic representation of the complex plan. By analyzing the decomposing method and the action node structure, we prove that the store space size of this graphic representation is not increased exponentially when the action node added.