These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Although intrusion alerts can provide threat intelligence regarding attacker
strategies, extracting such intelligence via existing tools is expensive and
time-consuming. Earlier work has proposed SAGE, which generates attack graphs
from intrusion alerts using unsupervised sequential machine learning. This
paper proposes a querying and prioritization-enabled visual analytics dashboard
for SAGE. The dashboard has three main components: (i) a Graph Explorer that
presents a global view of all attacker strategies, (ii) a Timeline Viewer that
correlates attacker actions chronologically, and (iii) a Recommender Matrix
that highlights prevalent critical alerts via a MITRE ATT&CK-inspired attack
stage matrix. We describe the utility of the proposed dashboard using intrusion
alerts collected from a distributed multi-stage team-based attack scenario. We
evaluate the utility of the dashboard through a user study. Based on the
responses of a small set of security practitioners, we find that the dashboard
is useful in depicting attacker strategies and attack progression, but can be
improved in terms of usability.
External Datasets
intrusion alerts from Collegiate Penetration Testing Competition (CPTC)