DUCG for Cybersecurity: An Exploratory Concept

From alert lists to hypotheses#

Security teams may receive alerts from different systems that describe symptoms at different points in a possible attack. The article’s central idea is to connect those observations to candidate causes and stages, so an analyst can inspect a possible causal story rather than treating every alert as independent.

It sketches an attack-causality graph whose variables could include assets, vulnerabilities, alerts, and tactics. In principle, evidence from several sensors could update the relative support for competing hypotheses such as data theft, ransomware deployment, or cryptomining.

Why the graph is not a detector by itself#

The proposal depends on a trustworthy knowledge model: relationships need to reflect actual system architecture and threat behavior, alert reliability must be calibrated, and missing or misleading signals must be handled explicitly. The article identifies graph construction and knowledge engineering as challenges but does not report an implementation or evaluation against a baseline.

A practical study would need a defined threat model, labeled or expert-reviewed incidents, false-positive and missed-detection measures, and tests on cases not used to build the graph. Until then, the idea should be read as a conceptual application of causal reasoning.

The Chinese original contains the longer motivation, example variables, and discussion of modeling challenges.