OPTIMIZING CYBERSECURITY INVESTMENT STRATEGY USING GENETIC ALGORITHM: BALANCING RISK MITIGATION AND INVESTMENT COST

Dataset for the study Optimizing Cybersecurity Investment Strategy Using Genetic Algorithm: Balancing Risk Mitigation and Investment Cost. The study formulates the selection of a cybersecurity control portfolio as a bi-objective 0-1 knapsack problem, minimizing investment cost and maximizing risk mitigation, and solves it with NSGA-II. Risk mitigation is measured as weighted coverage of MITRE ATT&CK Enterprise v16.1 techniques computed with a set union, so that a technique mitigated by several controls is counted once. FILES 01_coverage_matrix.csv - the coverage matrix A in wide form. 26 rows, one per commercial security control category. With 168 binary columns named by ATT&CK technique ID, where 1 means that category mitigates that technique. 02_techniques_metadata.csv - the technique universe and the threat-weight vectors. 168 rows, one per ATT&CK Enterprise v16.1 parent technique. Columns are the weights where it is an integers from 2 to 10, where a higher value means the technique is more critical to the organization. The weights are not normalized, so profile totals differ (908, 972, and 843 respectively) and coverage percentages are comparable only within the same profile. 03_mapping_long_format.csv - the same matrix in long form, including the zero entries, for users who prefer a tidy format. 4,368 rows, one per control-technique pair. Columns: Tool_ID, Tool_Name, Price_USD, Technique_ID, Technique_Name, Tactic, Mitigates, where Mitigates is 0 or 1. 04_tools_metadata.csv - the control catalogue and the cost vector. 26 rows. Columns: Tool_ID, Tool_Name, Category, Price_USD, Coverage_Count. Price_USD is the annual licence cost in US dollars for a reference organization of about 300 endpoints, rounded to the nearest thousand. Coverage_Count is the number of techniques the category mitigates. The catalogue totals USD 703,000 (just an example). nist_800_53-rev5_attack-16.1-enterprise.xlsx - the Center for Threat-Informed Defense mapping of NIST SP 800-53 Rev. 5 to ATT&CK Enterprise v16.1, included unmodified as the reference source. It contains 5,410 relation rows, of which 5,314 are mitigation statements, covering 109 NIST SP 800-53 Rev. 5 controls. ATTRIBUTION Technique identifiers, technique names, and tactic classifications in 02_techniques_metadata.csv are taken from the MITRE ATT&CK Enterprise v16.1 Excel release, available at https://attack.mitre.org/docs/attack-excel-files/v16.1/enterprise-attack/enterprise-attack-v16.1.xlsx. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use: https://attack.mitre.org/resources/legal-and-branding/terms-of-use/ nist_800_53-rev5_attack-16.1-enterprise.xlsx is the Center for Threat-Informed Defense mapping of NIST SP 800-53 Rev. 5 to ATT&CK Enterprise v16.1, included unmodified. It is the xlsx form of the same mapping release published at https://ctid.mitre.org/mappings/data/nist_800_53/attack-16.1/nist_800_53-rev5/enterprise/nist_800_53-rev5_attack-16.1-enterprise.csv