Multistep Cyberattacks Detection using a Flexible Multilevel System for Alerts and Events Correlation
Elvira Castillo-Fernández, Jesús E. Dı́az-Verdejo, Rafael Estepa, Antonio Estepa, Javier Muñoz-Calle, Germán Madinabeitia · 2023
Current network monitoring systems tend to generate several alerts per attack, especially in multistep attacks. However, Cybersecurity Officers (CSO) would rather receive a single alert summarizing the entire incident. Triggering a single alert per attack is a challenge that requires developing and evaluating advanced event correlation techniques and models to determine the relationships between the different observed events/alerts.