MCM-CASR: Novel alert correlation framework for cyber attack scenario reconstruction based on NLP, NER, and semantic similarity
Mouhamadou Lamine Diakhame, Cherif Diallo, Mohamed Mejri
Informations
- Revue / Journal
- 2023 7th Cyber Security in Networking Conference (CSNet)
- Éditeur
- IEEE
- ISBN
- 979-8-3503-4287-1
Résumé
Cyber attack scenario reconstruction plays a crucial role in understanding and mitigating security breaches. In this paper, we propose a novel framework that leverages Natural Language Processing (NLP), specifically Named Entity Recognition (NER), and semantic similarity techniques to reconstruct cyber attack scenarios. By analyzing Intrusion Detection alerts, our offline approach identifies relevant entities, detects relationships between them, and measures semantic similarity to uncover hidden patterns and connections. We demonstrate the effectiveness of our framework through experimental evaluations using a public dataset. The results highlight the potential of NLP-based approaches in cyber attack scenario reconstruction.