An Improved Attack Scenarios Reconstructing Method Based on Causal Correlation
LI Lian-min · Microelectronics & Computer · 2009
Causal correlation method was one of the most representative methods for reconstructing attack scenario. However, the correlation graph would be split because of missing alerts in some condition. This paper proposes an improved attack scenario reconstructing method based on causal correlation. The method identifies the correlation graphs to be integrated through alert relativity, and reasons out missing alerts by analyzing network vulnerability and exploit. The experimental results show that the method is valid to combine the split correlation graphs and reconstruct attack scenario.