Constructing Attack Scenario using Sequential Pattern Mining with Correlated Candidate Sequences *

With the rise of cyber attacks, the amount of audited security data such as alerts produced from Intrusion Detection Systems (IDSs) are increased dramatically. The analysis and management of these massive amounts of alerts have become a critical and challenging issue. Alert correlation is a very useful approach to reduce the volume of alerts and discover multi-stage attack scenarios. In this paper we propose a framework to recognize multi-stage attack scenarios with their associated severity level in real time. Sequential mining algorithm is used to discover attacks patterns and predict upcoming attacks. To improve the accuracy of generated patterns, we incorporated candidate verification that calculates alerts correlativity while generating candidate attacks sequences. Simultaneously, the framework identifies severity rank of discovered multi-stage attack scenarios.