Real-time attack scenario reconstruction method based on incremental alert analysis

Zhao Xinjian; Tang Huimin; Chen Shi; Zhang Yujian; Zhang Song; Cheng Guang

doi:10.11959/j.issn.2096-109x.AQ25274

您当前的位置：

首页 >

文章列表页 >

Real-time attack scenario reconstruction method based on incremental alert analysis

Papers | 更新时间：2026-05-11

- Real-time attack scenario reconstruction method based on incremental alert analysis
- Chinese Journal of Network and Information Security Vol. 12, Issue 2, Pages: 143-155(2026)
- 作者机构：
  
  1.国网江苏省电力有限公司信息通信分公司，江苏南京 210024
  2.东南大学网络空间安全学院，江苏南京 211189
- 作者简介：
- 基金信息：
  
  The Science and Technology Project of State Grid JiangSu Electric Power Company(J2024086)
- DOI：10.11959/j.issn.2096-109x.AQ25274
  CLC： TP393
- Received：29 November 2025，
  
  Revised：2026-03-24，
  
  Accepted：24 March 2026，
  
  Published：25 April 2026
- 稿件说明：
移动端阅览
赵新建, 汤慧敏, 陈石, 等. 基于告警增量分析的攻击场景实时重构方法[J]. 网络与信息安全学报, 2026, 12(2): 143-155.

Zhao Xinjian, Tang Huimin, Chen Shi, et al. Real-time attack scenario reconstruction method based on incremental alert analysis[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 143-155.
赵新建, 汤慧敏, 陈石, 等. 基于告警增量分析的攻击场景实时重构方法[J]. 网络与信息安全学报, 2026, 12(2): 143-155. DOI： 10.11959/j.issn.2096-109x.AQ25274.

Zhao Xinjian, Tang Huimin, Chen Shi, et al. Real-time attack scenario reconstruction method based on incremental alert analysis[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 143-155. DOI： 10.11959/j.issn.2096-109x.AQ25274.

摘要

面对日益复杂的多阶段、长周期网络攻击，安全事件常表现出跨时空域的交织关联。攻击场景重构能够有效支撑溯源取证和威胁发现，然而现有在攻击结束后基于全量告警数据分析的方法，存在结果滞后和效率低等问题。为此，针对告警信息的增量更新和全局视角存在矛盾问题，提出了基于时间窗口的增量式攻击场景重构方法。该方法的主要技术创新如下：①通过预处理和时间窗口划分，实现告警数据的规范化表达和分析规模的有效控制；②针对单窗口增量更新数据，以目标资产为中心构建攻击告警图并挖掘频繁1-项集，在此基础上通过图遍历策略生成并筛选所有可能攻击路径；③针对多个窗口的全局视角数据，提出一种攻击路径融合算法对已有路径和增量路径进行关联，实现攻击场景的全局重构。在开源和真实数据集上的实验结果表明，所提方法能够有效实现攻击场景重构，同时相比全量分析方法显著降低了计算复杂度，在增量场景下保持了稳定的处理性能。

Abstract

In the face of increasingly complex multi-stage and long-term cyber attacks

security events often exhibit interconnections across both temporal and spatial domains. Attack scenario reconstruction plays a crucial role in supporting traceability

forensics

and threat discovery. However

existing methods that rely on analyzing full alert data after an attack has concluded suffer from issues such as delayed results and efficiency bottlenecks. To address the inherent tension between incremental alert updates and a global perspective

an incremental attack scenario reconstruction method based on time window was proposed. The key technical innovations of the proposed method were as follows: ①Through preprocessing and time-window partitioning

normalized representation of alert data was achieved while effectively controlling the analysis scale; ②For incrementally updated data within a single window

an attack alert graph was constructed centered on target assets as well as mining frequent 1-itemsets

followed by the use of a graph traversal strategy to generate and filter all possible attack paths; ③For multi-window data from a global perspective

an attack path fusion algorithm was introduced to correlate historical paths with incremental paths

enabling global reconstruction of the attack scenario. Experimental results on both open-source and real-world datasets demonstrate that the proposed method effectively achieved attack scenario reconstruction while significantly reducing computational complexity compared to full analysis method

maintaining stable processing performance in incremental scenarios.

关键词

Keywords

references

王郅伟 , 何睎杰 , 易鑫 , 等 . 基于APT活动全生命周期的攻击与检测综述 [J ] . 通信学报 , 2024 , 45 ( 9 ): 206 - 228 .

Wang Z W , He X J , Yi X , et al . Survey of attack and detection based on the full life cycle of APT [J ] . Journal on Communications , 2024 , 45 ( 9 ): 206 - 228 .

胡源 , 薛松 , 张寒 , 等 . 近30年全球大停电事故发生的深层次原因分析及启示 [J ] . 中国电力 , 2021 , 54 ( 10 ): 204 - 210 .

Hu Y , Xue S , Zhang H , et al . Cause analysis and enlightenment of global blackouts in the past 30 years [J ] . Electric Power , 2021 , 54 ( 10 ): 204 - 210 .

樊迪 , 刘静 , 庄俊玺 , 等 . 基于因果知识发现的攻击场景重构研究 [J ] . 网络与信息安全学报 , 2017 , 3 ( 4 ): 58 - 68 .

Fan D , Liu J , Zhuang J X , et al . Research on attack scenario reconstruction method based on causal knowledge discovery [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 4 ): 58 - 68 .

潘亚峰 , 朱俊虎 , 周天阳 . APT攻击场景重构方法综述 [J ] . 信息工程大学学报 , 2021 , 22 ( 1 ): 55 - 60 .

Pan Y F , Zhu J H , Zhou T Y . Survey on APT attack scenario reconstruction methods [J ] . Journal of Information Engineering University , 2021 , 22 ( 1 ): 55 - 60 .

Bryant B D , Saiedian H . Improving SIEM alert metadata aggregation with a novel kill-chain based classification model [J ] . Computers and Security , 2020 , 94 ( 2 ): 101817 .

Barzegar M , Shajari M . Attack scenario reconstruction using intrusion semantics [J ] . Expert Systems with Applications , 2018 , 108 : 119 - 133 .

Kenaza T , Aiash M . Toward an efficient ontology-based event correlation in SIEM [J ] . Procedia Computer Science , 2016 , 83 : 139 - 146 .

王英州 , 张耀方 , 徐有方 , 等 . 工业控制系统物理层报警量关联算法 [J ] . 网络与信息安全学报 , 2025 , 11 ( 1 ): 178 - 188 .

Wang Y Z , Zhang Y F , Xu Y F , et al . Physical layer alarm correlation algorithm for industrial control system [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 1 ): 178 - 188 .

Yang J , Zhang Q , Jiang X F , et al . Poirot: causal correlation aided semantic analysis for advanced persistent threat detection [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 5 ): 3546 - 3563 .

Zang X D , Gong J , Zhang X C , et al . Attack scenario reconstruction via fusing heterogeneous threat intelligence [J ] . Computers and Security , 2023 , 133 : 103420 .

张玉臣 , 孙澄 , 姜迎畅 , 等 . 融合威胁情报与知识图谱的网络攻击溯源方法 [J ] . 情报杂志 , 2024 , 43 ( 8 ): 72 - 83, 91 .

Zhang Y C , Sun C , Jiang Y C , et al . A traceability method of network attacks combining threat intelligence and knowledge graph [J ] . Journal of Intelligence , 2024 , 43 ( 8 ): 72 - 83, 91 .

Zhao J , Tang T , Bu B , et al . Graph neural network-based attack prediction for communication-based train control systems [J ] . CAAI Transactions on Intelligence Technology , 2024 : cit2 . 12288.

Wang X Y , Gong X R , Yu L , et al . MAAC: novel alert correlation method to detect multi-step attack [C ] // Proceedings of the 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) . Piscataway : IEEE Press , 2021 : 726 - 733 .

Wang W B , Yi P , Jiang J F , et al . Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack [J ] . Computers and Security , 2024 , 136 : 103533 .

Haas S , Fischer M . GAC: graph-based alert correlation for the detection of distributed multi-step attacks [C ] // Proceedings of the 2018 ACM Symposium on Applied Computing . New York : ACM , 2018 : 979 - 988 .

Hu H , Liu J , Zhang Y C , et al . Attack scenario reconstruction approach using attack graph and alert data mining [J ] . Journal of Information Security and Applications , 2020 , 54 : 102522 .

Jia B W , Tian Y Z , Zhao D , et al . Bidirectional RNN-based few-shot training for detecting multi-stage attack [C ] // Proceedings of the 16th International Conference on Information Security and Cryptology . Berlin : Springer , 2021 : 37 - 52 .

Farhadi H , Amirhaeri M , Khansari M . Alert correlation and prediction using data mining and HMM [J ] . The ISC International Journal of Information Security , 2011 , 3 ( 2 ): 77 - 101 .

吕磊 , 刘家宇 , 李琦 , 等 . 基于改进序列模式挖掘算法的告警关联模型 [J ] . 电讯技术 , 2023 , 63 ( 6 ): 911 - 917 .

Lyu L , Liu J Y , Li Q , et al . Alert association model based on improved sequence pattern mining algorithm [J ] . Telecommunication Engineering , 2023 , 63 ( 6 ): 911 - 917 .

Mao B , Liu J , Lai Y , et al . MIF: a multi-step attack scenario reconstruction and attack chains extraction method based on multi-information fusion [J ] . Computer Networks , 2021 , 198 : 108340 .

ATT&CK v19 . [EB] . 2026 .

Defense Advanced Research Projects Agency (DARPA) . 2000 DARPA intrusion detection evaluation data set [EB ] . 2025 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on attack scenario reconstruction method based on causal knowledge discovery

Related Author

Di FAN

Jing LIU

Jun-xi ZHUANG

Ying-xu LAI

Related Institution

Faculty of Information Technology, Beijing University of Technology

Beijing Key Laboratory of Trusted Computing,Beijing University of Technology

National Engineering Laboratory for Critical Technologies of Information Security Classified Protection,Beijing University of Technology

⁰