Automatic multistep attack pattern discovering

Current techniques employed in security alert correlation area for multi-step attack recognition purpose are intri-cate to be performed due to the complexity of the meth-ods and huge computing workload generated during alert analysis and processing. In this paper, we proposed a new method of alert correlation aiming at providing concen-trated security event information and thus finding multi-step attack patterns accordingly. We use a kind of exten-sion time window when aggregate the alerts into high level alerts. We then connect hyper alerts into candidate multi-step attack patterns according to their IP address associa-tion. The final real multi-step attack patterns are discov-ered from these connected attack patterns with quantita-tive correlation calculation method. The method is easy to implement and practical to deploy which is proved by the result of our experiments. The experiment also shows our approach can effectively find real multi-step attack behavior patterns and can be used to identify true attack threats