Rule-Based Cyber Incident Detection and Response for Higher Education in Low-Resource Contexts: A Case Study of Universities in Eastern Uganda

Higher education institutions (HEIs) in developing countries are increasingly dependent on digital systems for teaching, administration, and research. However, resource-constrained universities remain highly vulnerable to cyber threats such as phishing, ransomware, and web application attacks. To address these challenges, this study adopted the Design Science Methodology (DSM) to design, implement, and evaluate a lightweight, rule-based cyber incident analysis and response algorithm specifically tailored for universities in Eastern Uganda. The approach combined contextual data collection from six universities with simulation-based evaluations to ensure both practical relevance and technical validity. The algorithm, developed on a Laravel-PHP-MySQL stack, integrates rule-based detection, correlation of multi-stage attacks, and an administrative dashboard for IT staff. Simulation results showed strong performance with a recall of 92.8%, precision of 91.3%, and an F1-score of 92.1%. Response latency remained below 100 milliseconds, and the system maintained stability up to 450 requests per second. Benchmarking against Snort demonstrated higher precision and lower resource consumption, though Snort achieved slightly higher recall. This research contributes a context-appropriate and cost-effective cybersecurity framework for HEIs in low-resource contexts. It extends the Defense-in-Depth (DiD) and Resource-Based View (RBV) theories to constrained environments and provides practical recommendations for implementing modular, rule-based detection systems to enhance cybersecurity resilience in African universities