Skip to main content

Table 1 All types of event relations [16]

From: Big knowledge-based semantic correlation for detecting slow and low-level advanced persistent threats

Relation type # Event relation Meaning
Object 1 \(\ e_i \overset{te}{\sim } e_j\) \((t_i < t_j) \wedge (o_i=o_j)\)
2 \(e_i \overset{ti}{\sim } e_j\) \(t_i < t_j) \wedge \left( (o_i \ne o_j) \wedge ( o_i \xrightarrow {partOf} o_j ) \right)\)
3 \(e_i \overset{pi}{\sim } e_j\) \((t_i < t_j) \wedge \left( (o_i \ne o_j) \wedge ( o_j \xrightarrow {partOf} o_i ) \right)\)
Subject 4 \(e_i \overset{it}{\sim } e_j\) \((t_i < t_j) \wedge (s_i = s_j) \wedge Thread (s_i)\)
5 \(e_i \overset{ip}{\sim } e_j\) \((t_i < t_j) \wedge Thread(s_i)\wedge Thread(s_j) \wedge \exists s_k, (Process(s_k) \wedge s_i \xrightarrow {partOf} s_k \wedge s_j \xrightarrow {partOf} s_k)\)
6 \(e_i \overset{ih}{\sim } e_j\) \((t_i < t_j) \wedge Thread(s_i) \wedge Thread(s_j) \wedge \exists s_k,s_m, (\ Process(s_k) \wedge Process(s_m) \wedge s_i \xrightarrow {partOf} s_k \wedge\) \(s_j \xrightarrow {partOf} s_m \wedge s_k \ne s_m\ ) \wedge \exists s_t, (\ Host(s_t)\wedge s_k \xrightarrow {partOf} s_t \wedge s_m \xrightarrow {partOf} s_t)\)
7 \(e_i \overset{bh}{\sim } e_j\) \((t_i < t_j) \wedge Thread(s_i) \wedge Thread(s_j) \wedge \exists s_k,s_m, ( Process(s_k) \wedge Process(s_m) \wedge s_i \xrightarrow {partOf} s_k \wedge\) \(s_j \xrightarrow {partOf} s_m \wedge s_k \ne s_m ) \wedge \ \exists s_t,s_p, (Host(s_t) \wedge Host(s_p) \wedge\) \( s_k \xrightarrow {partOf} s_t \wedge \ s_m \xrightarrow {partOf} s_p \wedge \ s_t \ne s_p\ ) \)
Action 8 \(\ e_i \overset{XY}{\sim } e_j\) \((t_i < t_j) \wedge (a_i=X) \wedge (a_i=Y)\)