Attack scenarios reasoning,hypothesizing and predicting based on capability transition model - TIAN Zhi-hong1; ZHANG Wei-zhe1; ZHANG Yong-zheng2; ZHANG Hong-li 1; LI Yang2; JIANG Wei1 (Tongxin xuebao)
To construct attack scenarios and predict intrusion intents automatically,a real-time alert correlation approach based on capability transition model was proposed.By highly abstracting the reasoning evidences,the process complexity is effectively reduced.Experiment results on the DARPA2000 IDS test dataset indicate that the method is effective and efficient.