System and method associated with expedient detection and reconstruction of cyber events in a compact scenario representation using provenance tags and customizable policy

A method for detecting a cyber-attack and reconstructing events associated with a cyber-attack campaign in a victim system environment, the method comprising:

• a processing device coupled to a memory that stores instructions, the processing device executing a real-time attack scenario reconstruction application with the instructions stored in memory, wherein the application is configured to perform the following operations:
• receiving an audit data stream associated with cyber events;
• identifying trustworthiness values in a portion of data associated with the cyber events;
• assigning provenance tags to the portion of the data based on the identified trustworthiness values;
• generating an initial visual representation based on the assigned provenance tags to the portion of the data;
• condensing the initial visual representation based on a backward traversal of the initial visual representation in identifying a shortest path from a suspect process and/or file to an entry point process and/or file;
• and
• generating a scenario visual representation that specifies processes and/or files in the victim system environment having a higher likelihood, compared to other processes and/or files in the victim system environment, of contributing to the cyber events associated with the cyber-attack based on the identified shortest path.

A non-transitory computer-readable medium storing instructions that, when executed by a real-time attack scenario reconstruction processing device, performs operations that include:

• receiving an audit data stream associated with cyber events associated with a cyber-attack in a victim system environment;
• identifying trustworthiness values in a portion of data associated with the cyber events;
• assigning provenance tags to the portion of the data based on the identified trustworthiness values;
• generating an initial visual representation based on the assigned provenance tags to the portion of the data;
• condensing the initial visual representation based on a backward traversal of the initial visual representation in identifying a shortest path from a suspect process and/or file to an entry point process and/or file;
• and
• generating a scenario visual representation that specifies processes and/or files in the victim system environment having a higher likelihood, compared to other processes and/or files in the victim system environment, of contributing to the cyber events associated with the cyber-attack based on the identified shortest path.