DETECTION OF MULTI-STEP COMPUTER PROCESSES SUCH AS NETWORK INTRUSIONS

摘要

Multi-step processes such as intrusions into computer networks are detected from individual activities or events such as communications by identifying anchor points (Fig 2, 220) that are likely to be part of the process, proceeding from the anchor points to extract other activitiesas a context of the anchor points, and characterizing the process from the activities in the context. The process may be characterized as sets of context activities.