Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection

摘要: Intrusion Detection Systems (IDSs) automatically analyze event logs and network traffic in order to detect malicious activity policy violations. Because IDSs have a large number of false positives negatives the technical nature their alerts requires lot manual analysis, researchers proposed approaches that automate analysis large-scale attacks predict attacker’s next steps. Unfortunately, many such use unique datasets success metrics, making comparison difficult. This survey provides an overview state art detecting projecting cyberattack scenarios, with focus on evaluation corresponding metrics. Representative papers are collected while using Google Scholar Scopus searches. Mutually comparable metrics calculated several tables provided. Our results show commonly used saturated popular cannot assess practical usability approaches. In addition, knowledge bases require constant maintenance, data mining ML depend quality available datasets, which, at time writing, not representative enough provide general regarding attack so more emphasis needs be placed researching behavior attackers.