Evidential Cyber Threat Hunting

When a suspicious event decision manifolds in cyber threat hunting. is detected in the monitoring data, the conventional course of action is to generate an intrusion alert in order to To better characterize the dynamics of advanced cyber notify a security analyst about a potential threat. In threats, this paper formalizes a cyber reasoning framework response to the incident, the analyst correlates the alert based on multi-functors that define structure-preserving to different sources of intelligence (both internal and mappings (a.k.a.