<![CDATA[Taking the botnet incident response plan decision-making as an example, we construct a new graph model to represent complex plan resolution domain by using action decomposition. In this model we introduced action layer, relation between subactions and decompose the complex incident response plan into many layers. This graphic model provides a powerful representing framework on the complex plan domain. By analyzing the decomposing method and the action node structure, we prove that the store space size of this graphic representation is not increased exponentially when the action node added. We present a quantitatively analyzing algorithm on the plan resolution domain. DOI: http://dx.doi.org/10.11591/telkomnika.v11i1.1869]]>
