Attack scenarios reasoning,hypothesizing and predicting based on capability transition model

Abstract

To construct attack scenarios and predict intrusion intents automatically,a real-time alert correlation approach based on capability transition model was proposed.By highly abstracting the reasoning evidences,the process complexity is effectively reduced.Experiment results on the DARPA2000 IDS test dataset indicate that the method is effective and efficient.

Keywords

• Internet security;attack scenario;capability transition model;intrusion detection