@inproceedings{d42e432377a54b1aad5ac8cba8d5be39,
title = "Understanding multistage attacks by attack-track based visualization of heterogeneous event streams",
abstract = "In this paper, we present a method of handling the visualization of hetereogeneous event traffic that is generated by intrusion detection sensors, log files and other event sources on a computer network from the point of view of detecting multistage attack paths that are of importance. We perform aggregation and correlation of these events based on their semantic content to generate Attack Tracks that are displayed to the analyst in real-time. Our tool, called the Event Correlation for Cyber-Attack Recognition System (EC-CARS) enables the analyst to distinguish and separate an evolving multistage attack from the thousands of events generated on a network. We focus here on presenting the environment and framework for multistage attack detection using ECCARS along with screenshots that demonstrate its capabilities.",
keywords = "Attack tracks, Intrusion detection, Visualization",
author = "S. Mathew and R. Giomundo and S. Upadhyaya and M. Sudit and A. Stotz",
year = "2006",
doi = "10.1145/1179576.1179578",
language = "English",
isbn = "1595935495",
series = "Proceedings of the 3rd International Workshop on Visualization for Computer Security, VizSEC'06. Co-located with the 13th ACM Conference on Computer and Communications Security, CCS'06",
pages = "1--5",
booktitle = "Proceedings of the 3rd International Workshop on Visualization for Computer Security, VizSEC'06. Co-located with the 13th ACM Conference on Computer and Communications Security, CCS'06",
note = "3rd International Workshop on Visualization for Computer Security, VizSEC'06. Co-located with the 13th ACM Conference on Computer and Communications Security, CCS'06 ; Conference date: 03-11-2006 Through 03-11-2006",
}