Although intrusion alerts can provide threat intelligence regarding attacker
strategies, extracting such intelligence via existing tools is expensive and
time-consuming. Earlier work has proposed SAGE, which generates attack graphs
from intrusion alerts using unsupervised sequential machine learning. This
paper proposes a querying and prioritization-enabled visual analytics dashboard
for SAGE. The dashboard has three main components: (i) a Graph Explorer that
presents a global view of all attacker strategies, (ii) a Timeline Viewer that
correlates attacker actions chronologically, and (iii) a Recommender Matrix
that highlights prevalent critical alerts via a MITRE ATT&CK-inspired attack
stage matrix. We describe the utility of the proposed dashboard using intrusion
alerts collected from a distributed multi-stage team-based attack scenario. We
evaluate the utility of the dashboard through a user study. Based on the
responses of a small set of security practitioners, we find that the dashboard
is useful in depicting attacker strategies and attack progression, but can be
improved in terms of usability.
外部データセット
intrusion alerts from Collegiate Penetration Testing Competition (CPTC)