During a computer security investigation, a security analyst has to explore the logs available
to understand what happened in the compromised system. For such tasks, visual analysis …

The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports is very
important to effectively identify and quickly respond to cyber threats. However, this …

In order to find attack patterns from a large number of redundant alert logs, build multi-step
attack scenarios, and eliminate the false alerts of the alert logs, this paper proposes a new …

Advanced cyberattacks are carried out in multiple stages, where each stage performs a
specific task corresponding to the campaign. While these steps are designed to blend in with …

Modern information society depends on reliable functionality of information systems
infrastructure, while at the same time the number of cyber-attacks has been increasing over …

In 2012, Google first proposed the knowledge graph and applied it in the field of intelligent
searching. Subsequently, knowledge graphs have been used for in-depth association …

Attack graph modeling aims to generate attack models by investigating attack behaviors
recorded in intrusion alerts raised in network security devices. Attack models can help …

Attack graphs have been widely used for attack modeling, alert correlation, and prediction. In
order to address the limitations of current approaches–scalability and impact analysis–we …

Attack graphs are widely used for modeling attack scenarios that exploit vulnerabilities in
computer systems and networked infrastructures. Essentially, an attack graph illustrates a …

Advanced cyber attacks consist of multiple stages aimed at being stealthy and elusive. Such
attack patterns leave their footprints spatio-temporally dispersed across many different logs …