Security Metric Methods for Network Multistep Attacks Using AMC and Big Data Correlation Analysis

Algorithm 3

Pseudocode for calculating ENV.

Input: Real - time alert flow

Output: Matrix N and threat ranking of middle alert nodes

(1)  Use  Algorithm 1  to fuse original alert flow to generate different class clusters.

(2)  For   to h

(3)where h is the number of clusters

(4)Use Algorithm 2 to construct n×n transition probability matrix P of .

(5)Generate   matrix Q from P according to Definition 2.

(6)Calculate foundational matrix .

(7)For   to

(8)Rank , ,L, in value decreasing.

(9)Return matrix N and the node ranking.

(10)End

(11)  End