# A Hierarchical Security Event Correlation Model for Real-Time Threat Detection and Response
## 3 Experiments and Results
### Results and Discussion
The edges are created between two communicating hosts, with the direction of the arrow showing the direction of the traffic flow. This analysis can provide a quick visual analysis of the network. Where a node has many outgoing edges, it shows a high talker. Many incoming edges would be indicative of a popular service being available on that host, but it could also signal a potential DDoS attack in progress. One of the appealing elements of graph correlation is visualization. In the graph above, the red color was used to flag out all nodes that had more than five outgoing connections. More outgoing connections could signify a sweep attack if the trace contains probe traffic. This helps the analyst to investigate nodes for further details. The parameter for flagging is configurable in the analytics. According to the Gflow graph above, four hosts had at least two outgoing connections to different targets in the data set under analysis. The orange color is for nodes exceeding a threshold number of incoming connections. In this experiment, the threshold was two. The first aspect of correlation performance is the resource utilization of the correlation system by measuring the time of the entire correlation process (aggregation, level 1 correlation, clustering, and level 2 graph correlation) as well as peak memory usage. The measurements were taken for each time slot. From the results shown earlier in Table 7, the charts in Figure 11 show the correlation performance. As can be seen from the charts, the correlation process's run time and peak memory usage increased with an increasing number of events, clusters, and hyperevents. Apart from the run-time performance, two metrics are commonly used to measure the effectiveness of the correlation. A core component of our model, and all correlation systems, is to aggregate the data source into a smaller data set. Two metrics are used for this measurement. Completeness measures how well the events are correlated and is given by Equation (13). \[R_{c}=\frac{correctly\,correlated\,events}{related\,events} \tag{13}\]  
Soundness measures how correctly the events are correlated and is given by the equation below. \[R_{s}=\frac{correctly\,correlated\,events}{correlated\,events} \tag{14}\]  
Figure 10: Cluster interconnection graph for time slot 1. To measure the performance of the correlation algorithm, the same approach as above was used; however, the time was measured only for the clustering algorithm part of the correlation process. The algorithm run-time performance is plotted in Figure 12 below. The results show that in general, the run time of the algorithm increased linearly with the size of the input. For an input of size \(n\), the performance observed was \(\mathcal{O}(n)\). Our clustering algorithm has a time complexity of \(\mathcal{O}(n)\). This is better performance compared to the complexity of alternatives such as K-means and CLIQUE, which have time complexities of \(\mathcal{O}(n^{2})\)[39] and \(\mathcal{O}(3^{n/3})\)[40], respectively, where \(n\) is the input data size. Table 8 compares the correlation performance of our model with the work of other related works. Figure 11: Correlation performance. Figure 12: Performance of the clustering algorithm.