HeATed Alert Triage (HeAT): Transferrable Learning to Extract Multistage Attack Campaigns. (arXiv:2212.13941v1 [cs.CR])

With growing sophistication and volume of cyber attacks combined with complex
network structures, it is becoming extremely difficult for security analysts to
corroborate evidences to identify multistage campaigns on their network. This
work develops HeAT (Heated Alert Triage): given a critical indicator of
compromise (IoC), e.g., a severe IDS alert, HeAT produces a HeATed Attack
Campaign (HAC) depicting the multistage activities that led up to the critical
event. We define the concept of "Alert Episode Heat" to represent the analysts …

alert alert triage attack extract heat triage