Severity-Based Triage of Cybersecurity Incidents Using Kill Chain Attack Graphs

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F25%3A00140500" target="_blank" >RIV/00216224:14330/25:00140500 - isvavai.cz</a>

Result on the web

<a href="https://www.sciencedirect.com/science/article/pii/S2214212624002588" target="_blank" >https://www.sciencedirect.com/science/article/pii/S2214212624002588</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1016/j.jisa.2024.103956" target="_blank" >10.1016/j.jisa.2024.103956</a>

Result language

angličtina

Original language name

Severity-Based Triage of Cybersecurity Incidents Using Kill Chain Attack Graphs

Original language description

Security teams process a vast number of security events. Their security analysts spend considerable time triaging cybersecurity alerts. Many alerts reveal incidents that must be handled first and escalated to the more experienced staff to allow appropriate responses according to their severity. The current state requires an automated approach, considering contextual relationships among security events, especially detected attack tactics and techniques. In this paper, we propose a new graph-based approach for incident triage. First, it generates a kill chain attack graph from host and network data. Second, it creates sequences of detected alerts that could represent ongoing multi-step cyber attacks and matches them with the attack graph. Last, it assigns severity levels to the created sequences of alerts according to the most advanced kill chain phases that were used and the criticality of assets. We implemented the approach using the MulVAL attack graph generator and generation rules for MITRE ATT&amp;CK techniques. The evaluation was accomplished in a testbed where multi-step attack scenarios were executed. Classification of sequences of alerts based on computed match scores obtained 0.95 area under the receiver operating characteristic curve in a feasible time. Moreover, a threshold exists for classifying 80% of positive sequences correctly and only a small percentage of negative sequences wrongly. Therefore, the approach selects malicious sequences of alerts and significantly improves incident triage.

Czech name

—

Czech description

—

Type

J_imp - Article in a specialist periodical, which is included in the Web of Science database

CEP classification

—

OECD FORD branch

10200 - Computer and information sciences

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2025

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Name of the periodical

Journal of Information Security and Applications

ISSN

2214-2126

e-ISSN

—

Volume of the periodical

89

Issue of the periodical within the volume

March 2025

Country of publishing house

NL - THE KINGDOM OF THE NETHERLANDS

Number of pages

18

Pages from-to

1-18

UT code for WoS article

001417203200001

EID of the result in the Scopus database

2-s2.0-85215132045