Investigating Episode Prioritisation in Alert-Driven Attack Graphs: Analysing PICA: A Novel Approach to Episode Prioritisation

Intrusion Detection Systems (IDSes) detect malicious traffic in computer networks and generate a large volume of alerts, which cannot be processed manually. SAGE is a deterministic algorithm that works without a priori network/expert knowledge and can compress these alerts into attack graphs (AGs), modelling intruders’ paths in the network....