Skip to content

Real-Time Detection of Multi-Stage Attacks using Kill Chain State Machines: Detect multi-stage attacks by correlating alerts from Intrusion Detection Systems (IDS) to generate scenario graphs. By prioritising alerts based on the kill chain model the RT-KCSM reduces false-positive alerts.

License

Notifications You must be signed in to change notification settings

UHH-ISS/rt-kcsm

Repository files navigation

Run experiments

Prerequisites:

  • Golang 1.24
  • Node.js 23.11.0
  • npm 10.9.2
  • Python 3.13
  • Jupyter Notebook
  • bash or zsh

Install RT-KCSM from source with Golang

cd src/web/
npm install
tsc
rollup -c
cd ..
go install .
cd ..

Make sure you have the go binaries folder in your $PATH variable.

Run the evaluation setup

cd evaluation
./run-evaluation.sh

Wait until it has finished. Now run all steps of the Jupyter Notebook(s):

  • evaluation/performance.ipynb
  • evaluation/detection.ipynb

The result figures are located in evaluation/figures/

About

Real-Time Detection of Multi-Stage Attacks using Kill Chain State Machines: Detect multi-stage attacks by correlating alerts from Intrusion Detection Systems (IDS) to generate scenario graphs. By prioritising alerts based on the kill chain model the RT-KCSM reduces false-positive alerts.

Topics

Resources

License

Security policy

Stars

Watchers

Forks

Packages