Graphs-based method for detecting cyber threats in a real-time systems

This work develops an approach to cybersecurity that involves the creation and implementation of a system for detecting and mitigating threats. The system utilizes network and alert graphs to model and understand the complex interconnections between vulnerabilities, attack methods, and protective measures. The network graph displays known vulnerabilities, connections, and attack paths, while the alert graph monitors vulnerabilities and potential attack routes based on real-time alerts. The methodology for selecting countermeasures is based on a detailed analysis of security metrics and risk for specific nodes within the network. A dynamic algorithm evaluates and prioritizes protective actions, taking into account the cost, intrusiveness, and effectiveness of the countermeasures. The effectiveness of the method is confirmed by experiments in a private cloud environment, demonstrating its ability to protect critical virtual resources and enhance the overall security level of the network.