2026-09-19T00:00:36Z https://api.figshare.com/v2/oai

oai:figshare.com:article/31451818 2025-12-01T00:00:00Z portal_693 item_type_8 month_year_12_2025

From Alerts to Defense: Towards Building Adaptive Frameworks for Detection, Correlation, and Response Sutanu Kumar Ghosh (23292112) Attack Detection Alert Correlation Incident Response Security Operation Centers work under sustained alert load and must investigate a significant number of alerts daily, and must do so with confidence. This dissertation presents three frameworks that operate on commodity audit telemetry and help analysts correlate activity, investigate alerts with publicly available intelligence in the loop, and take guarded endpoint actions. We first present Ostinato, a cross-host correlation system that turns Windows and Linux audit feeds into a typed provenance graph and aligns similar subgraphs across machines. The alignment preserves causal roles, so process to file writes and process to socket opens retain meaning even when names and exact tools differ. The result is a compact scenario graph and timeline that shows scope, pivots, and ordering, and remains stable when clocks drift or logs arrive out of order. We then introduce Citar, a tool that brings cyber threat intelligence into day-to-day alert investigations. Citar maps alerts to potential apt groups, and tries to find other artifacts related to an attack that could be present in the host. It then correlates matched artifacts to a seed alert through a point-to-point traversal, so the outcome is a readable scenario rather than scattered hits. When paired with existing detection mechanisms, Citar increases coverage by up to 57% in our study of public datasets and enterprise-style simulations, while reducing investigation times. Finally, we present Spade, a response framework that assists containment on endpoints while keeping humans in control. Spade encodes a typed view of the host state and lets a learned agent propose an action to mitigate or disrupt attacker actions. Every proposal passes through a safety gate that masks non-applicable or unsafe choices and exposes the mask to the analyst. Training uses replayed traces with the same encoder used at deployment, so observations remain stable. Agents escalate from monitor to higher impact actions only when corroborating signals accumulate, which reduces attacker progress while preserving availability. All three tools consume the same host-level audit level logs that are widely utilized and then normalize them into provenance graphs with different enrichment techniques. All three prefer small, faithful explanations over large graphs or opaque scores and keep analysts in the loop through narratives they can review, intelligence-driven checks they can run, and guarded actions they can control. We evaluate the tools on public multi-host traces, operationally realistic replays, and our custom-generated apt dataset that follows community technique mappings. Across these settings, Ostinato reconstructs concise multi-host narratives from noisy input, Citar improves investigative efficiency and coverage, and Spade proposes safe actions that reduce time to containment while maintaining service continuity. 2025-12-01T00:00:00Z Text Thesis 10.25417/uic.31451818.v1 https://figshare.com/articles/thesis/From_Alerts_to_Defense_Towards_Building_Adaptive_Frameworks_for_Detection_Correlation_and_Response/31451818 In Copyright Open Access after 2028-01-01