Model for identifying attack propagation patterns in a monitored sensor-based system

摘要

A method for generating a model of propagation patterns in monitored sensor-based systems for identifying such propagation patterns, according to which metadata concerning monitored cyber-attacks is obtained and portions of attacks from the metadata are contextually filtered, for reaching a desirable set of attacks for modeling. Then sessions and sequences of attacks, as well as a propagation graph, representing the propagation of attacks across the network, are created. The propagation graph is analyzed for identifying attacker behavior and a model of the analysis is then stored in a memory.