Attack plan recognition and prediction using causal networks
Constructing attack scenarios through correlation of intrusion alerts