Correlation in an Intrusion Detection Process
Frédéric Cuppens, Fabien Autrel, Alexandre Miège, Salem Benferhat, Re Mi Ege · 2002
Generally, the intruder must perform several actions, organized in an intrusion scenario, to achieve his or her malicious objective. We argue that intrusion scenarios can be modelled as a planning process and we suggest modelling a malicious objective as an attempt to violate a given security requirement.