A novel technique of recognizing multi-stage attack behaviour

Since security audit data increased so dramatically, management and analysis of these security data become a critical and challenge issue. SATA (security alerts and threat analysis project) aims at analyzing the security events and detecting the security threat. In this paper, we proposed a novel method of constructing attack scenarios model in order to recognize multi-stage attack behaviour and predict potential attack steps of the attacker. Our method based on statistical method using the feature of time consecution association of contextual attack steps. Besides, we proposed a new method of computing the correlativity between two contextual attacks which enhances the correlationship of the attack scenarios model and ensures the accuracy of the final correlation result. The idea is easy to implement and it can be used to detect novel multi-stage attacks. Experiment shows that our method is effective and feasible