An Attack Scenario Reconstruction Technology Based on Alert Correlation Analysis

At present, the security threats faced by cyberspace are becoming more and more severe. The use of IDS (Intrusion Detection System) to detect attack behaviors has become a necessary method to ensure network security. However, in actual environments, IDS will generate a large number of redundant alerts, and security operators cannot efficiently identify the attacker's intentions from massive alerts. To address the above problems, we propose an attack scenario reconstruction technology based on alert association analysis. First, the original alerts are aggregated according to the multi-dimensional attribute similarity to reduce redundancy. Then, the candidate attack sequences are divided using a dynamic sliding time window and the alert risk level, and a probabilistic deterministic finite automaton (PDFA) is trained to extract the attack path and restore the attacker's intention. Experiments show that this method can effectively reduce the redundancy of alerts and reconstruct attack scenarios.