基于告警增量分析的攻击场景实时重构方法OA

In the face of increasingly complex multi-stage and long-term cyber attacks,security events often exhibit interconnections across both temporal and spatial domains.Attack scenario reconstruction plays a crucial role in supporting traceability,forensics,and threat discovery.However,existing methods that rely on analyzing full alert data after an attack has concluded suffer from issues such as delayed results and efficiency bottlenecks.To address the inherent tension between incremental alert updates and a global perspective,an incremental attack scenario re-construction method based on time window was proposed.The key technical innovations of the proposed method were as follows:①Through preprocessing and time-window partitioning,normalized representation of alert data was achieved while effectively controlling the analysis scale;②For incrementally updated data within a single win-dow,an attack alert graph was constructed centered on target assets as well as mining frequent 1-itemsets,followed by the use of a graph traversal strategy to generate and filter all possible attack paths;③For multi-window data from a global perspective,an attack path fusion algorithm was introduced to correlate historical paths with incre-mental paths,enabling global reconstruction of the attack scenario.Experimental results on both open-source and real-world datasets demonstrate that the proposed method effectively achieved attack scenario reconstruction while significantly reducing computational complexity compared to full analysis method,maintaining stable processing performance in incremental scenarios.