Alert correlation survey: framework and techniques
Modeling Multistep Cyber Attacks for Scenario Recognition