Cybercrime is estimated to have cost the global economy just under USD 1 trillion in 2020,
indicating an increase of more than 50% since 2018. With the average cyber insurance …

Security event correlation approaches are necessary to detect and predict incremental
threats such as multi-step or targeted attacks (advanced persistent threats) and other causal …

Abstract Information systems need to process a large amount of event monitoring data. The
process of finding the relationships between events is called correlation, which creates a …

Nowadays, new-generation threats often use multiple means or perform several steps to
intrude into networks and ultimately reach their objective. These new threats have multi …

Intrusion Detection Systems (IDSs) automatically analyze event logs and network traffic in
order to detect malicious activity and policy violations. Because IDSs have a large number of …

SQL injection attack (SQLIA) is one of the most severe attacks that can be used against web
database driving applications. Attackers use SQLIA to get unauthorized access and perform …

Existing alert correlation methods do not consider the unsuccessful paths and true negative
alerts of IDS, which affects the completeness and visualization of attack restoring. To …

Today, human security analysts need to sift through large volumes of alerts they have to
triage during investigations. This alert fatigue results in failure to detect complex attacks …

Abstract A Network Intrusion Detection System is a network security technology for detecting
intruder attacks. However, it produces a great amount of low-level alerts which makes the …

Correlating individual alerts to reconstruct attack scenarios has become a critical issue in
identifying multi-step attack paths. Most of existing reconstruction approaches depend on …