Investigating the Impact of Merging Sink States on Alert-Driven Attack Graphs: The effects of merging sink states with other sink states and the core of the S-PDFA

SAGE is an unsupervised sequence learning pipeline that generates alert-driven attack graphs (AGs) without the need for prior expert knowledge about existing vulnerabilities and network topology. Using a suffix-based probabilistic deterministic finite automaton (S-PDFA), it accentuates infrequent high-severity alerts without discarding frequent...