Graph-based attack chain discovery in enterprise security systems

摘要: Methods and systems for detecting anomalous events include in monitored system data. An event correlation graph is generated based on the data that characterizes tendency of processes to access targets. Kill chains are connect malicious over a span time from characterize an attack path by sorting according maliciousness value determining at least one sub-graph within with above-threshold rank. A security management action performed kill chains.