Graph-based Event Correlation for Network Security Defense
Open AccessOrganizations of all types and their computer networks are constantly under threat of attack. While the overall detection time of these attacks is getting shorter, the average detection time of weeks to months allows the attacker ample time to potentially cause damage to the organization. Current detection methods are primarily signature based and typically rely on analyzing the available data sources in isolation. Any analysis of how the individual data sources relate to each other is usually a manual process, and will most likely occur as a forensic endeavor after the attack identification occurs via other means. The use of graph theory and the graph databases built to support its application can provide a repeatable and automated analysis of the data sources and their relationships. By aggregating the individual data sources into a graph database based on a model that supports the data types and relationships, database queries can extract information relevant to the detection of attack behavior within the network. The work in this Praxis shows how the graph model and database queries will reduce the overall time to detection of a successful attack by enabling defenders to understand better how the data elements and what they represent are related.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.