Skip to main content

Table 3 Patterns of transition rules [16]

From: Big knowledge-based semantic correlation for detecting slow and low-level advanced persistent threats

# Rule
1 \(Subject(s_i) \wedge Subject(s_j) \wedge (s_i \xrightarrow {partOf} s_j ) \Longrightarrow me(s_j)= me(s_j) \cup me(s_i)\)
2 \(Subject(s_i) \wedge Subject(s_j) \wedge (s_i \xrightarrow {partOf} s_j ) \Longrightarrow ma(s_j)= ma(s_j) \cup ma(s_i)\)
3 \(Process(s_i) \wedge Process(s_j) \wedge (s_i \xrightarrow {parentOf} s_j ) \Longrightarrow me(s_j)= me(s_j) \cup me(s_i)\)
4 \(Process(s_i) \wedge Process(s_j) \wedge (s_i \xrightarrow {parentOf} s_j ) \Longrightarrow ma(s_j)= ma(s_j) \cup ma(s_i)\)
5 \(Event(e_i) \wedge Object(o_j) \wedge (o_j \xrightarrow {partOf} object(e_i) ) \wedge (action(e_i)=R) \Longrightarrow me(subject(e_i)):=me(subject(e_i)) \cup \{o_j\}\)
6 \(Event(e_i) \wedge Object(o_j) \wedge (o_j \xrightarrow {partOf} object(e_i) ) \wedge (action(e_i)=W ) \Longrightarrow ma(subject(e_i)):=ma(subject(e_i)) \cup \{o_j\}\)
7 \(Event(e_i) \wedge Object(o_j) \wedge (o_j \xrightarrow {partOf} object(e_i) ) \wedge (action(e_i)=D) \Longrightarrow ma(subject(e_i)):=ma(subject(e_i)) \cup \{o_j\}\)
8 \(Event(e_i) \wedge Event(e_j) \wedge action(e_i)=W \wedge action(e_j)=R \wedge object(e_i) = object(e_j) \wedge UT(subject(e_i)) \Rightarrow me(subject(e_j))= me(subject(e_j)) \cup me(subject(e_i))\)
9 \(Event(e_i) \wedge Event(e_j) \wedge action(e_i)=W \wedge action(e_j)=R \wedge object(e_i) \xrightarrow {partOf} object(e_j) \wedge UT(subject(e_i)) \Rightarrow me(subject(e_j))= me(subject(e_j)) \cup me(subject(e_i))\)
10 \(Event(e_i) \wedge Event(e_j) \wedge UT(subject(e_i)) \wedge (action(e_i)=W) \wedge (object(e_i)=subject(e_j)) \wedge (action(e_j)=W)\)
  \(\Rightarrow ma(subject(e_i)):=ma(subject(e_i)) \cup \{object(e_j)\}\)
11 \(Event(e_i) \wedge Event(e_j) \wedge UT(subject(e_i)) \wedge (action(e_i)=W) \wedge (object(e_i)=subject(e_j)) \wedge (action(e_j)=D)\)
  \(\Rightarrow ma(subject(e_i)):=ma(subject(e_i)) \cup \{object(e_j)\}\)
12 \(Event(e_i) \wedge Event(e_j) \wedge UT(subject(e_i)) \wedge (action(e_i)=C) \wedge (object(e_i)=subject(e_j)) \wedge (action(e_j)=W)\)
  \(\Rightarrow ma(subject(e_i)):=ma(subject(e_i)) \cup \{object(e_j)\}\)
13 \(Event(e_i) \wedge Event(e_j) \wedge UT(subject(e_i)) \wedge (action(e_i)=C) \wedge (object(e_i)=subject(e_j)) \wedge (action(e_j)=D)\)
  \(\Rightarrow ma(subject(e_i)):=ma(subject(e_i)) \cup \{object(e_j)\}\)