Situation Awareness of multistage cyber attacks by semantic event fusion

In this paper, we present strategies for real-time Situation Awareness of multistage cyber-attacks by utilizing heterogeneous sensor event streams. A flexible and practically usable attack modeling approach based on network connectivity and attack progression semantics is used to produce multistage attack templates. Events in live alert streams are correlated based on their semantics and the attack templates to provide analysts with effective perception, comprehension and projection of likely attacks and their progression. The techniques form the basis of the Event Correlation for Cyber Attack Recognition System (ECCARS), which is tested and validated extensively with realistic datasets.