Skip to main content

Table 1 All types of event relations [16]

From: Big knowledge-based semantic correlation for detecting slow and low-level advanced persistent threats

Relation type

#

Event relation

Meaning

Object

1

\(\ e_i \overset{te}{\sim } e_j\)

\((t_i < t_j) \wedge (o_i=o_j)\)

2

\(e_i \overset{ti}{\sim } e_j\)

\(t_i < t_j) \wedge \left( (o_i \ne o_j) \wedge ( o_i \xrightarrow {partOf} o_j ) \right)\)

3

\(e_i \overset{pi}{\sim } e_j\)

\((t_i < t_j) \wedge \left( (o_i \ne o_j) \wedge ( o_j \xrightarrow {partOf} o_i ) \right)\)

Subject

4

\(e_i \overset{it}{\sim } e_j\)

\((t_i < t_j) \wedge (s_i = s_j) \wedge Thread (s_i)\)

5

\(e_i \overset{ip}{\sim } e_j\)

\((t_i < t_j) \wedge Thread(s_i)\wedge Thread(s_j) \wedge \exists s_k, (Process(s_k) \wedge s_i \xrightarrow {partOf} s_k \wedge s_j \xrightarrow {partOf} s_k)\)

6

\(e_i \overset{ih}{\sim } e_j\)

\((t_i < t_j) \wedge Thread(s_i) \wedge Thread(s_j) \wedge \exists s_k,s_m, (\ Process(s_k) \wedge Process(s_m) \wedge s_i \xrightarrow {partOf} s_k \wedge\) \(s_j \xrightarrow {partOf} s_m \wedge s_k \ne s_m\ ) \wedge \exists s_t, (\ Host(s_t)\wedge s_k \xrightarrow {partOf} s_t \wedge s_m \xrightarrow {partOf} s_t)\)

7

\(e_i \overset{bh}{\sim } e_j\)

\((t_i < t_j) \wedge Thread(s_i) \wedge Thread(s_j) \wedge \exists s_k,s_m, ( Process(s_k) \wedge Process(s_m) \wedge s_i \xrightarrow {partOf} s_k \wedge\) \(s_j \xrightarrow {partOf} s_m \wedge s_k \ne s_m ) \wedge \ \exists s_t,s_p, (Host(s_t) \wedge Host(s_p) \wedge\) \( s_k \xrightarrow {partOf} s_t \wedge \ s_m \xrightarrow {partOf} s_p \wedge \ s_t \ne s_p\ ) \)

Action

8

\(\ e_i \overset{XY}{\sim } e_j\)

\((t_i < t_j) \wedge (a_i=X) \wedge (a_i=Y)\)