Causal Discovery of Cyber Attack Phases

Abstract

Causal discovery algorithms are increasingly being used to discover valid, novel, and significant causal relationships from large amounts of observational data. Cyberattacks are hypothesized to evolve according to the Cyber Kill Chain® which consists of a causal model describing the phases of a cyberattack. This paper introduces causal discovery to cybersecurity research and provides evidence of the kill chain with an extensive empirical assessment of two databases of real cyberattacks.