Abstract Information systems need to process a large amount of event monitoring data. The
process of finding the relationships between events is called correlation, which creates a …

Security event correlation approaches are necessary to detect and predict incremental
threats such as multi-step or targeted attacks (advanced persistent threats) and other causal …

Network Intrusion Detection Systems (NIDS) are designed to safeguard the security needs of
enterprise networks against cyber-attacks. However, NIDS networks suffer from several …

Cyber Physical Systems (CPS) operating in modern critical infrastructures (CIs) are
increasingly being targeted by highly sophisticated cyber attacks. Threat actors have quickly …

SIEM (Software Information and Event Management) systems are becoming increasingly
commonplace in scenarios as diverse as ICT environments or Critical infrastructures …

Managing and supervising security in large networks has become a challenging task, as
new threats and flaws are being discovered on a daily basis. This requires an in depth and …

Today, from information security perspective, prevention methods are not enough solely.
Early Warning Systems (EWSs) are in the category of reactive methods. These systems are …

Alert Correlation is a key part of intrusion detection technique. Traditional methods based on
the situation awareness techniques usually store the different dimensions of security …

Current Security Information and Event Management systems (SIEMs) constitute the central
platform of modern security operations centers. They gather events from multiple sensors …

Event Correlation used to be a widely used technique for interpreting alert logs and
discovering network attacks. However, due to the scale and complexity of today's networks …