Attack scenarios reasoning,hypothesizing and predicting based on capability transition model
Hongli Zhang · Journal of Communications · 2007
To construct attack scenarios and predict intrusion intents automatically,a real-time alert correlation approach based on capability transition model was proposed.By highly abstracting the reasoning evidences,the process complexity is effectively reduced.Experiment results on the DARPA2000 IDS test dataset indicate that the method is effective and efficient.