CAPTURE: Efficient Attack Investigation Through Causal Alert Correlation Analysis

Attack investigation is a vital approach for countering modern network attacks, which are often highly concealed and adversarial. From a proactive defense perspective, developing efficient and automated methods for attack investigation is of great significance as it enhances the ability to respond rapidly to complex network attacks. By representing system audit logs as provenance graphs that capture causal dependencies among attack events, and leveraging the strong correlation analysis and semantic capabilities of these graphs, we can effectively investigate complex and concealed network attacks, yielding substantial improvements compared to traditional methods. However, complex multi-stage network attacks can generate numerous alert points within the network. During the attack investigation process, analyzing this vast amount of alert data places a significant burden on human and computational resources, leading to what is known as “alert fatigue”. To address this challenge, we propose CAPTURE, a novel system designed to expedite attack investigation by employing causal alert correlation analysis in multi-alert scenarios. By optimizing the provenance graph through the search for alert-related subgraphs and connecting alert points using a reverse priority queue-based BFS search, CAPTURE alleviates the investigative workload. Our experiments across 5 attack datasets demonstrate that CAPTURE can effectively reduce the size of the investigation graph by 250 times. Furthermore, when compared to state-of-the-art methods, CAPTURE reduces investigation time by 32.13%. Importantly, it accurately reconstructs complete attack scenarios.