Steffen Haas, Mathias Fischer: GAC: graph-based alert correlation for the detection of distributed multi-step attacks. SAC 2018: 979-988