Scalable Detection of Cyber Attacks

摘要: Attackers can exploit vulnerabilities to incrementally penetrate a network and compromise critical systems. The enormous amount of raw security data available analysts the complex interdependencies among make manual analysis extremely labor-intensive error-prone. To address this important problem, we build on previous work topological vulnerability analysis, propose an automated framework manage very large attack graphs monitor high volumes incoming alerts for occurrence known patterns in real-time. Specifically, (i) structure that merges multiple enables concurrent monitoring types attacks; (ii) index effectively millions time-stamped alerts; (iii) real-time algorithm process continuous stream alerts, update index, detect occurrences. We show proposed solution significantly improves state art cyber detection, enabling detection.