# A Hierarchical Security Event Correlation Model for Real-Time Threat Detection and Response
## 2 Proposed Approach
### Level 2--Graph Correlation  
The clusters from the first level are fed into the second level for additional correlation using graphs. This level establishes cluster interconnections and communication patterns and enables visual analytics. The input is the set of clusters of events from the level 1  
Figure 4: Event clustering algorithm. correlation above, while the output is a series of interconnections and communication graph flows. Figure 5 below details the level 2 correlation block. The cluster interconnection stage takes the clusters created in the previous step and finds similarities between them to create a bigger picture view of the underlying communications captured in the clusters. The interconnection stage is used to reveal communication patterns in the network to establish normal and suspicious patterns. This model defines two graphs that are created to reveal cluster interconnections. **Definition 1**. : _A hyperevent correlation graph is defined as \(Gtyper=[M,E]\), a sequential, directed acyclic graph (DAG) representing correlations among clusters of events. The set \(M\) of nodes is the set of metaevents for all communication flows between the same source and destination hosts within the observation window. The metaevents are the clusters formed during the level 1 correlation described above. For two nodes \(m1,m2\in M\), an edge \(e\in E=(m1,m2)\) is created that connects \(m1\) to \(m2\) if the source and destination are similar for both metaevents. What constitutes a source and a destination is left to the implementation, according to the features mined. Possible examples could be source and destination IP addresses, source and destination port numbers, source and destination mac addresses, or any combination of source and destination features. Additionally, the edge is formed if metaevent \(m1\) occurred before metaevent \(m2\) according to the timestamps for the events. By sequencing the events, analytics that are based on the sequence of events can be executed by examining the data structure of Gtyper. In general, an edge in Gtyper is created if all the conditions below are satisfied._  
\[m1.src == m2.src \tag{9}\] \[m1.dst == m2.dst\] (10) \[m1.ts < m2.ts \tag{11}\]  
The objective is to interconnect related clusters and create a set of clusters of the hyperevents \(H=[c_{0},c_{1},\ldots,c_{n}]\), such that each cluster \(C_{i}\in C\) represents a collection of metaevents from the previous step with some similar attributes. This establishes multisession communication correlations among the single-session clusters established in stage 1 for the same communication pair. \(Gtyper\) is the first interconnection step of the process. Additionally, this model defines the graph \(Gflow\) which shows all the communication flow patterns in the network. **Definition 2**. : _A communications flow graph, \(GFlow=(M,E)\), is a directed acyclic graph (DAG) that shows the flow of communications in the network during the observation window. The set \(M\) of nodes is the set of metaevents from the level 1 correlation. For two nodes \(m1,m2\in M\), an edge \(e\in E=[m1,m2]\) is created that connects \(m1\) to \(m2\) if the destination of \(m1\) is the source \(m2\). An edge in Gflow is formed if the condition in the equation below is satisfied. Just as in Gtyper, what constitutes a source and a destination is left to the implementation._  
Figure 5: Graph-based correlation. \[m1.dst\ ==\ m2.src \tag{12}\]  
The principle is that an edge is formed if traffic is flowing from \(m1\) to \(m2\). Consider the communications in Table 5 below. The above communications could be represented by the following Gflow shown in Figure 6.  
Gflow provides important analytics. A node with multiple outgoing edges, for example, node A in the above graph, could indicate a high talker, or an intruder could be carrying out attacks such as sweep probes on hosts B and C. A node with multiple incoming edges, such as node C above, could be a popular service, such as DNS or DHCP, but it could also be a node under a DDoS attack.