Early Warning and Intrusion Detection based on Combined AI Methods

In this paper we survey the architecture and AI aspects in our project on early warningand intrusion detection based on combined AI methods. We address the problem of alarm assessment in intrusion detection and use plan reconstruction based on hierarchically organised procedural knowledge that contains descriptions of adversary actions. Reconstructed plans are supposed to correlate events and alarms from a SIEM and provide explanations for a security expert. We also aim at predicting the next steps of multi-stage intrusion attacks in computer networks. Therefore a probabilistic relational reasoning over time method based on hidden Markov